DumbWareio vulnerabilities
We track 3 vulnerabilities in DumbWareio products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on May 18, 2026.
Latest DumbWareio vulnerabilities
- 9.1 Critical severity
DumbAssets: Improper Limitation of a Pathname to a Restricted Directory
DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpoint and filesToDelete array parameters that allows unauthenticated attackers to delete arbitrary files by supplying ../ sequences that bypass directory boundary
- 9.5 Critical severity
DumbDrop: Improper Neutralization of Special Elements used in an OS Command
DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was discovered in the DumbDrop application, `/upload/init` endpoint. This vulnerability could allow an attacke
- 9.6 Critical severity
DumbDrop: Improper Limitation of a Pathname to a Restricted Directory
Dumb Drop is a file upload application. Users with permission to upload to the service are able to exploit a path traversal vulnerability to overwrite arbitrary system files. As the container runs as root by default, there is no limit to what can be overwritte