CVE-2026-29188
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- EPSS probability
- 0.49%
- CWE
- CWE-732, CWE-284
- Published
- 2026-03-05
- Last modified
- 2026-03-12
Affected products
- filebrowser filebrowser
Weakness type
Related vulnerabilities
- CVE-2026-84828 — Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token
- CVE-2026-19583 — Velociraptor Required Permissions bypass by using client monitoring queries
- CVE-2026-79617 — Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
- CVE-2026-80054 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-82312 — OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated...
- CVE-2026-80112 — PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys
- CVE-2021-43613 — SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
- CVE-2026-78604 — Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM