CVE-2026-36726 describes an arbitrary file deletion vulnerability in the bookcars application version 8.3. The vulnerability is located in the /api/delete-temp-license/{file} endpoint, which improperly validates user input, allowing unauthenticated attackers to perform directory traversal attacks and delete arbitrary files on the system. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges or user interaction, with impact limited to integrity loss (file deletion) but no confidentiality or availability impact. No official remediation or patch information is currently available, and no known exploits have been reported.

An attacker can delete arbitrary files on the affected system without authentication by exploiting directory traversal sequences in the vulnerable API endpoint. This compromises the integrity of the system by allowing unauthorized file deletions. There is no reported impact on confidentiality or availability. The vulnerability could disrupt normal operations or cause data loss depending on which files are deleted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable endpoint if possible, and monitor for suspicious activity targeting this API. Avoid exposing the endpoint to untrusted networks. No official fix or temporary workaround has been published.