CVE-2026-75464: n/a

CVE-2026-75464 is an authenticated arbitrary file deletion vulnerability affecting OneNav version 1.2.4. The vulnerability occurs through the import_link() function, which improperly handles file deletion requests from authenticated users. This can lead to unauthorized deletion of files, impacting system integrity and availability. The CVSS v3.1 base score is 8.1, reflecting a network attack vector with low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. There is no vendor advisory or patch information available at this time.

An authenticated attacker can delete arbitrary files on the affected system, potentially disrupting service availability and compromising system integrity. There is no confidentiality impact reported. The vulnerability requires the attacker to have some level of privileges (authenticated user). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to the minimum necessary and monitor for suspicious file deletion activities related to the import_link() functionality.