CVE-2026-36726
MEDIUMbookcars 8.3 - Unauthenticated Arbitrary File Deletion via Directory Traversal
Title source: llmDescription
An arbitrary file deletion vulnerability in the /api/delete-temp-license/{file} endpoint of bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via supplying directory traversal sequences.
References (1)
Core 1
Scores
CVSS v3
5.3
EPSS
0.0051
EPSS Percentile
39.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Published
Jun 09, 2026
Tracked Since
Jun 10, 2026