PT-2026-40054 · Nexenta · Nexent

Published 2026-05-12 · Updated 2026-05-26 · CVE-2026-31215

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions nexent version 1.7.5.2

Description The backend service contains an unauthorized arbitrary file deletion issue within its ElasticSearch service interface. The 'DELETE /{index name}/documents' endpoint lacks proper authentication and authorization controls and fails to validate the path or url parameter. This allows unauthenticated remote attackers to send crafted requests that trigger the deletion of arbitrary documents from ElasticSearch indices and associated files from the MinIO storage system, resulting in data destruction and denial of service.

Recommendations For version 1.7.5.2, restrict access to the 'DELETE /{index name}/documents' endpoint or avoid using the path or url parameter until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2026-31215

Affected Products

Nexent

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-31215 · Security Note
• https://github.com/ModelEngine-Group/nexent · Note
• https://notion.so/CVE-2026-31215-35d1e139318881f5946ed206d96e34d8 · Note
• https://t.me/cveNotify/164712 · Telegram Post