Skip to content
OpenAdvisories

Vendor

DumbWareio

5 known vulnerabilities.

Products

DumbDrop 3 DumbAssets 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-45230

    DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file

    DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundar…

    DumbWareio DumbAssets
  • Critical 9.5
    CVE-2025-24971

    OS Command Injection endpoint '/upload/init' parameter 'filename' (RCE) in DumpDrop

    DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was discovered in the DumbDrop application, `/upload/init` endpoint. This vulnerability could allow an attack…

    DumbWareio DumbDrop
  • Critical 9.7
    CVE-2025-24891

    Dumb Drop has an arbitrary file overwrite and path traversal for root shell

    Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritt…

    DumbWareio DumbDrop