CVE-2026-29188

CRITICAL

9.1

Descricao

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

Detalhes CVE

Pontuacao CVSS v3.19.1

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado3/5/2026

Ultima modificacao3/10/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

filebrowser:filebrowser

Fraquezas (CWE)

CWE-284CWE-732

Referencias

https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f(security-advisories@github.com)

https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1(security-advisories@github.com)

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm(security-advisories@github.com)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.