What is the CVSS score of CVE-2026-29188?

CVE-2026-29188 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-29188?

Yes, a public proof-of-concept exploit is available for CVE-2026-29188. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-29188?

Within 24 hours: Identify all systems running vulnerable file browser software and restrict external access to file management interfaces. Within 7 days: Apply the available vendor patch to all affected systems in a staged rollout starting with critical assets. Within 30 days: Complete patching of all remaining systems and conduct vulnerability rescans to confirm remediation.

Filebrowser CVE-2026-29188

CRITICAL

Improper Access Control (CWE-284)

2026-03-05 security-advisories@github.com

GHSA-79pf-vx4x-7jmm

Authentication Bypass Filebrowser Suse

9.1

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate as user with Create permission
Exploit

Send DELETE request to TUS protocol endpoint
Execution

Bypass access control validation
Impact

Delete arbitrary files outside authorized scope

Vulnerability Assessment

Weakness	CWE CWE-284 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Access control enforcement MITRE ATT&CK 1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Multi-user File Browser deployment (versions before 2.61.1) where administrators have configured role-based access control restricting Delete permission for specific users. Attacker requires valid authentication credentials with Create permission only.
Impact	CVSS 9.1.
Exploit ScenarioDerived	Access files without authorization.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Unauthorized file operations in File Browser before fix. PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 9.1

Auth bypass in File Browser.

RemediationAI

Update.

Affected Packages

go github.com/filebrowser/filebrowser no fix

go github.com/filebrowser/filebrowser/v2 fix: 2.61.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-284.

Know when Filebrowser gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

SUSE CRITICAL

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 10, 2026 - 19:42 vuln.today

Public exploit code

Patch released

Mar 10, 2026 - 19:42 nvd

Patch available

CVE Published

Mar 05, 2026 - 21:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

Executive ViewAI

Why It Matters

CVE-2026-29188 is a critical vulnerability in file browser functionality that could allow attackers to gain unauthorized access to upload, delete, or modify files within your systems. With a public exploit available and a CVSS score of 9.1, this poses an immediate risk to data integrity and system availability across any organization using affected file management interfaces.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.1%

Top 84% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*

Related Vulnerabilities in File Browser Access Control and Bypass

View all 2

CVE-2026-28492 MEDIUM POC

6.5

More in Filebrowser

View all

CVE-2023-39612 CRITICAL Act Now POC

9.0 Sep 16

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr

CVE-2026-116682 HIGH This Week POC

8.6 Oct 27

Symlink-following read paths in FileBrowser Quantum serve files from outside a user's assigned scope: download, preview,

CVE-2026-73612 HIGH This Week POC

8.6 Aug 13

Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,

CVE-2026-25890 HIGH This Week POC

8.1 Feb 09

Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio

CVE-2025-52903 HIGH This Week POC

8.0 Jun 26

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2025-52904 HIGH This Week POC

8.0 Jun 26

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2025-52995 HIGH This Week POC

8.0 Jun 30

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2026-54910 HIGH This Week POC

7.7 Jul 20

Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, reg

CVE-2026-73611 HIGH This Week POC

7.6 Aug 13

File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut

CVE-2025-52902 HIGH This Week POC

7.6 Jun 26

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

CVE-2026-73613 HIGH This Week POC

7.2 Aug 13

Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet

CVE-2025-64523 HIGH This Week POC

7.2 Nov 12

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ

Same weakness CWE-284 – Improper Access Control

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2012-4681 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2012-1723 CRITICAL POC

9.8

CVE-2012-5076 CRITICAL POC

9.8

CVE-2014-3120 HIGH POC

8.1

CVE-2013-2423 LOW POC

3.7

CVE-2016-3427 CRITICAL

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

Vendor StatusVendor

SUSE

Severity: Critical

References

Advisories & patches

PATCH https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1042/ REF https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back