CVE-2026-79426

CRMEB v6.0.0, an open-source e-commerce/CRM platform, contains an arbitrary file deletion flaw (CWE-73) in its /adminapi/file/video_data_save component. An authenticated attacker with administrative API access can send a crafted POST request in which the file path is attacker-controlled, causing the server to delete arbitrary files on the host. By removing application files, configuration, or uploaded data, the attacker can cause data loss, disrupt or disable the storefront, and potentially degrade the platform's integrity and availability, consistent with the high-impact 7.2 CVSS score. Risk is limited to deployments running CRMEB v6.0.0 that expose the admin API, and exploitation requires prior high-privileged authentication. There is currently no known public PoC, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at about 0.3%, so no exploitation has been reported.

What to do: Audit CRMEB deployments for version 6.0.0 and limit access to the admin API endpoint /adminapi/file/video_data_save to trusted administrative accounts only. Check CRMEB's official releases or GitHub repository for a patched version beyond 6.0.0 and update when available; in the meantime, ensure server-side validation of file path parameters and monitor POST requests to the endpoint for unexpected path values. Since file deletion can destroy site data, verify that backups of stores running this version are current and restorable.