CRITICAL🇵🇱 Wersja polska

CVE-2026-29188

CVSS 9.1v3.1pub. 2026-03-05upd. 2026-03-10

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Filebrowser

    APP
    Filebrowser
    < 2.61.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-32760CRITICAL10.0PL ✓ten sam produkt

File Browser: niezabezpieczona rejestracja konta administratora bez uwierzytelnienia

CVE-2023-39612CRITICAL9.0ten sam produkt

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to e...

CVE-2026-35604HIGH8.2ten sam produkt

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit...

CVE-2026-35585HIGH7.5ten sam produkt

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit...

CVE-2026-35607HIGH8.1ten sam produkt

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit...