CVE-2026-54065: NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

July 13, 2026

Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root (e.g., config.php) by injecting a crafted attach parameter, rendering the application inoperable.

References

github.com/advisories/GHSA-c9xg-64p9-f2jj
github.com/nukeviet/nukeviet/security/advisories/GHSA-c9xg-64p9-f2jj
nvd.nist.gov/vuln/detail/CVE-2026-54065

Code Behaviors & Features

Detect and mitigate CVE-2026-54065 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →