CVE-2026-29188

CRITICAL
2026-03-05 [email protected] GHSA-79pf-vx4x-7jmm
9.1
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
PoC Detected
Mar 10, 2026 - 19:42 vuln.today
Public exploit code
Patch Released
Mar 10, 2026 - 19:42 nvd
Patch available
CVE Published
Mar 05, 2026 - 21:16 nvd
CRITICAL 9.1

Tags

Authentication Bypass Filebrowser

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

Analysis

Unauthorized file operations in File Browser before fix. PoC and patch available.

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Identify all systems running vulnerable file browser software and restrict external access to file management interfaces. Within 7 days: Apply the available vendor patch to all affected systems in a staged rollout starting with critical assets. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

66
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +46
POC: +20

Share

CVE-2026-29188 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy