CVE-2026-29188

CRITICAL

9.1

Beschreibung

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

CVE Details

CVSS v3.1 Bewertung9.1

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht3/5/2026

Zuletzt geandert3/10/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

filebrowser:filebrowser

Schwachen (CWE)

CWE-284CWE-732

Referenzen

https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f(security-advisories@github.com)

https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1(security-advisories@github.com)

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm(security-advisories@github.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.