A local arbitrary file deletion vulnerability in NoMachine 9.3.7 allows low-privileged attackers to gain elevated impact by deleting critical system files.

The vulnerability, categorized as CWE-73, stems from the insecure handling of environment variables that fail to validate user-supplied paths before performing file operations. An attacker must possess low-privileged local access to the target system to trigger this flaw.

The ability for a low-privileged user to delete arbitrary files as root poses a significant risk to system integrity and availability. Successful exploitation could lead to critical service disruption, system instability, or the removal of security-sensitive configuration files, justifying the 7.1 CVSS score.

Immediate Action: Monitor official NoMachine security advisories and apply the forthcoming patch as soon as it is released by the vendor.

Proactive Monitoring: Review system logs for unusual file deletion patterns or unexpected process execution from non-administrative user accounts.

Compensating Controls: Restrict local shell access for untrusted users and ensure that the NoMachine service is running with the minimum necessary privileges to reduce the potential for lateral movement or privilege escalation.

Public Exploit Available: No (exploit_available: false)

Given the potential for privilege escalation via file deletion, administrators should prioritize this vulnerability for remediation. Although no patch is immediately identified in the provided data, users are advised to maintain a strict posture regarding local user access and monitor for any updates from NoMachine that address this path validation flaw.