The nexent v1.7.5.2 backend service exposes a critical security flaw in its file management API. Specifically, the DELETE /storage/{object_name:path} endpoint does not enforce authentication or authorization controls and lacks input validation. This allows unauthenticated attackers to specify arbitrary file paths in the object_name parameter, enabling deletion of files stored in the MinIO storage system used by the service. The vulnerability can lead to significant data loss and cause denial of service conditions. No CVSS score or remediation details are currently provided.

Successful exploitation allows unauthenticated remote attackers to delete arbitrary files from the MinIO storage backend, resulting in data loss and denial of service. This compromises the availability and integrity of stored data managed by the nexent backend service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable API endpoint through network controls or firewall rules to prevent unauthenticated access. Monitor for unusual deletion activity if possible.