CVE-2026-29188

Name: CVE-2026-29188
Creator: NVD / NIST
Published: 2026-03-05T21:16:23.097+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.1/10EPSS 0.49%

Last modified Jun 17, 2026

CVE-2026-29188 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. EPSS estimates a 0.49% chance of exploitation in the next 30 days.

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

Metrics

CVSS 3.1

8.1/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS Probability

0.49%

38.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Filebrowser	Filebrowser	< 2.61.1

References

https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42fPatch
https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1Release Notes
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmmExploit, Vendor Advisory

Timeline

Published: Mar 5, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-29188?

How severe is CVE-2026-29188?

CVE-2026-29188 has a CVSS score of 8.1/10 (HIGH severity). The EPSS model estimates a 0.49% probability of exploitation in the next 30 days.

How do I fix CVE-2026-29188?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-29188?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST