CVE-2026-29188

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

State: Published
Severity: 9.1 Critical
Published: Mar 5, 2026
Updated: Mar 6, 2026
Reserved: Mar 4, 2026

Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	GitHub_M

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource
CWE-284 Improper Access Control

Affected Products

Product	Versions
filebrowserfilebrowser	< 2.61.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.