CVE-2026-29188: File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
Vulnerability summary
CVE-2026-29188 is a critical (CVSS 9.1) Improper Access Control vulnerability in filebrowser. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 45.3% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 05-03-2026PublishedVulnerability first disclosed.
- 06-03-2026Last modifiedVulnerability information updated.
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
Decrease -0.07 pp
From 0.61% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundFilebrowser
Maturity: poc
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Filebrowser1 product
- filebrowser< 2.61.1
Github.com/filebrowser1 product
- filebrowserAll versions (No fix recorded)
Github.com/filebrowser/filebrowser1 product
- v2< 2.61.1
3 vendors · 3 products
References
5 links- github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmmX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42fX Refsource MISCWEBFIXPatch
