The vulnerability in NukeViet's 'modules/comment/admin/edit.php' allows an authenticated administrator to perform path traversal via the 'attach' parameter in the Edit Comment function. The parameter is processed by stripping a fixed-length prefix but does not properly validate the resulting path, enabling storage of traversal sequences like '../../config.php' in the database. When the comment is deleted, the application calls 'nv_deletefile()' on the constructed path, which resolves the real path and only checks that it is within the application root directory (NV_ROOTDIR), not restricting deletion to the uploads directory. This allows deletion of arbitrary files within the root, including critical files such as 'config.php', causing application failure. The issue is fixed by adding 'nv_is_file()' validation to ensure the file path is within the designated upload directory before processing.

An authenticated administrator can delete any file within the application root directory readable by the web server process. This includes critical configuration files like 'config.php', whose deletion causes immediate application outage and triggers the install wizard, disrupting service availability. The integrity and availability of the application are severely impacted, though confidentiality is not affected.

A fix is available that adds validation of the 'attach' parameter using 'nv_is_file()' to ensure the file path resolves within the intended upload directory, rejecting any path traversal attempts. Users should upgrade to NukeViet version 4.6.00 or later where this validation is implemented. Until patched, administrators should avoid editing comments with attachments or intercepting/modifying the 'attach' parameter to prevent exploitation.