CVE-2025-65792

Technical Details

DataGear v5.5.0 is vulnerable to arbitrary file deletion due to insufficient input validation and sanitization in a specific function related to file management. An attacker can craft a malicious request containing a manipulated file path that, when processed by the vulnerable function, leads to the deletion of arbitrary files on the server's file system. This is possible because the application does not properly verify the user's authorization to delete the targeted file, nor does it adequately sanitize the provided file path to prevent directory traversal attacks. The lack of proper access control and input validation allows an attacker to bypass security measures and delete files outside of the intended scope.

The vulnerability stems from a flaw in how the application handles user-supplied file paths. By injecting special characters or sequences (e.g., '../') into the file path, an attacker can navigate up the directory structure and target files located outside the intended directory. The application's failure to properly sanitize these paths allows the attacker to bypass security checks and delete arbitrary files. This vulnerability can be exploited remotely without requiring authentication in some instances, depending on the specific configuration and deployment of DataGear.