Description

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-18T15:17:03.940Z",
  "pubdate": "2026-08-18T15:17:03.940Z",
  "executiveSummary": "An unauthenticated arbitrary content deletion vulnerability has been identified in the Breeze product affecting versions 2.5.12 and prior. This security flaw enables remote, unauthenticated threat actors to delete arbitrary files or content within the context of the affected application without requiring any prior authentication or privileged access. The impact of this vulnerability is severe, as successful exploitation can lead to operational disruption, denial of service through the removal of critical system or application files, and potential data loss depending on file system permissions and the targeted file paths. The risk implications are heightened due to the lack of access controls and authentication mechanisms protecting the vulnerable deletion functionality, allowing automated scanners or malicious actors to target exposed instances over the network. Remediation requires updating the Breeze software to a patched version beyond 2.5.12 or applying vendor-supplied security advisories to restrict unauthorized file manipulation operations.",
  "technicalDetails": "The vulnerability resides within the Breeze product, specifically affecting versions 2.5.12 and earlier, where improper handling of input parameters allows for unauthenticated arbitrary content deletion. The root cause stems from a lack of proper authorization checks and input validation in the file management or content processing components of the application. An unauthenticated attacker can interact with exposed network endpoints responsible for file management operations and craft malicious HTTP requests containing targeted file paths or identifiers. Because the application fails to validate whether the requester possesses the necessary administrative privileges or valid session tokens, the underlying system processes the request and executes the deletion routine against the specified target. The attack flow typically begins with network reconnaissance to identify an exposed Breeze instance running a vulnerable version. The attacker then crafts an exploit payload, often utilizing specific HTTP methods or parameters designed to invoke the vulnerable deletion function. Upon transmission of the payload to the vulnerable component, the application processes the input without adequate sanitization, leading to the unauthorized removal of files accessible to the application runtime environment. Depending on the privileges of the service account executing the application, this flaw can facilitate the deletion of critical configuration files, system dependencies, or user data. Network exposure is broad if the application is accessible via the internet or an untrusted local area network, lowering the barrier to entry for remote exploitation. No specific authentication requirements or privilege levels are needed to trigger the flaw, fulfilling the criteria for an unauthenticated remote attack vector."
}