Skip to content
Heist/ feed
Back to feed
Critical

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

Type: advisorySources: OSV

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-29188
Confirmed fixed CVEs
Not specified
Updated in this feed
7 Nov 2026, 02:28 UTC · Revision 1

Source evidence

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

core-osv · Original source

Published 5 Mar 2026, 20:57 UTC

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

osv:CVE-2026-29188
Complete source record
{
  "id": "a51025297d63e6255547627273a3a2e6197bef9f7e33672c704edf45c561187c",
  "url": "https://osv.dev/vulnerability/CVE-2026-29188",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "File Browser: TUS Delete Endpoint Bypasses Delete Permission Check",
    "summary": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.",
    "evidence": "osv:CVE-2026-29188",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-29188",
      "aliases": [
        "CVE-2026-29188",
        "GHSA-79pf-vx4x-7jmm",
        "GO-2026-4606"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/filebrowser/filebrowser",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "c950a57df8a513029edb6954e8845b9fc0134b62"
                },
                {
                  "fixed": "7ed1425115be602c2b23236c410098ea2d74b42f"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "2.61.1"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "7ed1425115be602c2b23236c410098ea2d74b42f"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "c950a57df8a513029edb6954e8845b9fc0134b62"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v2.61.1"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.61.0",
            "v2.60.0",
            "v2.59.0",
            "v2.58.0",
            "v2.57.1",
            "v2.57.0",
            "v2.56.0",
            "v2.55.0",
            "v2.54.0",
            "v2.53.1",
            "v2.53.0",
            "v2.52.0",
            "v2.51.2",
            "v2.51.1",
            "v2.51.0",
            "v2.50.0",
            "v2.49.0",
            "v2.48.2",
            "v2.48.1",
            "v2.48.0",
            "v2.47.0",
            "v2.46.1",
            "v2.46.0",
            "v2.45.3",
            "v2.45.2",
            "v2.45.1",
            "v2.45.0",
            "v2.44.2",
            "v2.44.1",
            "v2.44.0",
            "v2.43.0",
            "v2.42.5",
            "v2.42.4",
            "v2.42.3",
            "v2.42.2",
            "v2.42.1",
            "v2.42.0",
            "v2.41.0",
            "v2.40.2",
            "v2.40.1",
            "v2.40.0",
            "v2.39.0",
            "v2.38.0",
            "v2.37.0",
            "v2.36.3",
            "v2.36.2",
            "v2.36.1",
            "v2.36.0",
            "v2.35.0",
            "v2.34.2",
            "v2.34.1",
            "v2.34.0",
            "v2.33.10",
            "v2.33.9",
            "v2.33.8",
            "v2.33.7",
            "v2.33.6",
            "v2.33.5",
            "v2.33.4",
            "v2.33.3",
            "v2.33.2",
            "v2.33.1",
            "v2.33.0",
            "v2.32.3",
            "v2.32.2",
            "v2.32.1",
            "v2.32.0",
            "v2.31.2",
            "v2.31.1",
            "v2.31.0",
            "v2.30.0",
            "v2.29.0",
            "v2.28.0",
            "v2.27.0",
            "v2.26.0",
            "v2.25.0",
            "v2.24.2",
            "v2.24.1",
            "v2.24.0",
            "v2.23.0",
            "v2.22.4",
            "v2.22.3",
            "v2.22.2",
            "v2.22.1",
            "v2.22.0",
            "v2.21.1",
            "v2.21.0",
            "v2.20.1",
            "v2.20.0",
            "v2.19.0",
            "v2.18.0",
            "v2.17.2",
            "v2.17.1",
            "v2.17.0",
            "v2.16.1",
            "v2.16.0",
            "v2.15.0",
            "v2.14.1",
            "v2.14.0",
            "v2.13.0",
            "v2.12.1",
            "v2.12.0",
            "v2.11.0",
            "v2.10.0",
            "v2.9.0",
            "v2.8.0",
            "v2.7.0",
            "v2.6.2",
            "v2.6.1",
            "v2.6.0",
            "v2.5.0",
            "v2.4.0",
            "v2.3.0",
            "v2.2.0",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.16",
            "v2.0.15",
            "v2.0.14",
            "v2.0.13",
            "v2.0.12",
            "v2.0.11",
            "v2.0.10",
            "v2.0.9",
            "v2.0.8",
            "v2.0.7",
            "v2.0.6",
            "v2.0.5",
            "v2.0.4",
            "v2.0.3",
            "v2.0.2",
            "v2.0.1",
            "v2.0.0",
            "v2.0.0-rc.2",
            "v2.0.0-rc.1",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.0",
            "v1.7.1",
            "v1.7.0",
            "v1.6.0",
            "v1.5.5",
            "v1.5.4",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.4.6",
            "v1.4.5",
            "v1.4.4",
            "v1.4.3",
            "v1.4.0",
            "v1.3.12",
            "v1.3.11",
            "v1.3.10",
            "v1.3.9",
            "v1.3.8",
            "v1.3.7",
            "v1.3.6",
            "v1.3.5",
            "v1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.9",
            "v1.2.8",
            "v1.2.7",
            "v1.2.6",
            "v1.2.5",
            "v1.2.4",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29188.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:49.289719488Z",
      "provider": "osv",
      "references": [
        "https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29188.json",
        "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-29188",
        "https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-284",
          "CWE-732"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29188.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-29188",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 517360,
  "published_at": "2026-03-05T20:57:57.329+00:00"
}