CVE-2026-29188

The vulnerability results from improper access control (broken access control) in the DELETE endpoint of the TUS protocol, which is used for file uploads. The TUS protocol supports resumable file uploads, and its DELETE endpoint does not properly verify whether the calling user has Delete permission — only Create permission is checked. As a result, an authenticated user with Create permission can send DELETE requests to the TUS endpoint and delete files and directories that they would normally not have the right to delete.

An attacker with Create permission can permanently delete any files and directories within their scope, bypassing the access control policy established by the administrator. This can lead to data loss and violation of the integrity and availability of stored resources.

File Browser should be updated to version 2.61.1 or later, where the vulnerability has been patched. Details available in the official release: https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1

File Browser (filebrowser/filebrowser) in versions prior to 2.61.1. Affects only multi-user deployments where administrators explicitly restrict delete permissions for specific users.