CVE-2026-36726: Unauthenticated Arbitrary File Deletion in Bookcars v8.3

Technical summary

CVE-2026-36726 is a path traversal vulnerability (CWE-22) in the /api/delete-temp-license/{file} endpoint of bookcars v8.3. The endpoint accepts a file parameter but fails to sanitize or validate it against directory traversal attacks. By submitting specially crafted requests with path traversal sequences, an unauthenticated attacker can manipulate the file path to delete arbitrary files accessible to the application process. The vulnerability carries a CVSS 3.1 score of 5.3 (Medium severity) with no authentication required and low attack complexity.

Business impact

Successful exploitation could lead to denial of service through deletion of critical application files, configuration files, or data. In multi-tenant or SaaS deployments of bookcars, this could affect availability for legitimate users. While the vulnerability does not directly compromise confidentiality or enable data exfiltration, the integrity impact via file deletion could disrupt business operations, corrupt application state, or necessitate emergency recovery procedures and downtime.

Affected systems

Bookcars version 8.3 is affected. Organizations running this version with the /api/delete-temp-license endpoint exposed (typically in web-facing deployments) are at risk. The vulnerability requires no authentication, making any internet-accessible instance vulnerable if not otherwise restricted by network controls.

Exploitability

Exploitation requires only network access and the ability to craft HTTP requests to the vulnerable endpoint—no authentication, special user privileges, or user interaction is needed. The attack complexity is low, making this a straightforward exploitation scenario for an attacker with basic HTTP request capabilities. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, though this does not imply immunity from real-world attack.

Remediation

Upgrade bookcars to a patched version released after June 2026 that addresses path traversal validation in the /api/delete-temp-license endpoint. Verify the specific patched version against the official bookcars vendor advisory. Interim mitigations include network-level access controls (WAF rules blocking '../' sequences in that endpoint) and disabling or restricting access to the /api/delete-temp-license endpoint if not essential to operations.

Patch guidance

Check the official bookcars project repository and security advisories for the released patch version addressing CVE-2026-36726. Apply the patch at your earliest convenience given the Medium severity and unauthenticated attack vector. Verify patch deployment by confirming the version string and testing that path traversal payloads no longer result in file deletion. If your version cannot be immediately patched, prioritize restricting network access to affected endpoints.

Detection guidance

Monitor HTTP access logs for requests to /api/delete-temp-license/ containing suspicious path traversal patterns such as '../', '..\', URL-encoded variants (%2e%2e, %252e), or unicode representations. Implement Web Application Firewall (WAF) rules to block such sequences. Monitor file system events for unexpected deletions initiated by the web application process. Alert on any successful HTTP responses (200/204) to delete-temp-license requests, especially from untrusted sources.

Why prioritize this

Although Medium severity, this vulnerability warrants prompt attention because it requires no authentication and has low attack complexity. Attackers can disrupt service availability or corrupt application integrity without any barriers to entry. Prioritize it alongside other unauthenticated remote vulnerabilities in your exposure management workflow. The lack of KEV status does not reduce priority—it simply reflects current threat intelligence rather than imminent mass exploitation.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects an unauthenticated, network-accessible vulnerability (AV:N, PR:N) with low complexity (AC:L) that impacts file integrity but not confidentiality or availability in the strict scoring model. The Medium severity reflects the real-world risk: while not critical, an unauthenticated file deletion capability poses a material operational risk to deployed instances.

Frequently asked questions