CVE-2026-29188CWE-284CWE-732

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

Critical · published March 5, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
49.1
In the wild
Unconfirmed
What it is

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00622 · 49.1th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-03-05T20:57Z
EPSS history
Timeline
  • 05 MAR 20:57Z
    File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
    cvelistv5