CVE-2026-88621 is an authenticated arbitrary file deletion vulnerability in OneNav v1.2.4, specifically in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory, potentially causing file deletion and denial of service. The vulnerability requires verification of its existence and scope [truncated]
CVE-2026-75464 is a high-severity vulnerability in OneNav 1.2.4, allowing authenticated arbitrary file deletion via the import_link() function. Defenders should assess exposure, prioritize remediation, and verify affected versions and vendor fixes. This vulnerability has significant implications for system security, as it could allow attackers to delete critical files, potentially disrupting service. A th [truncated]
