Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm
Patch x_refsource_misc
https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f
Release Notes x_refsource_misc
https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1
Scores
CVSS v3
9.1
EPSS
0.0049
EPSS Percentile
37.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-284
CWE-732
Status
published
Products (1)
filebrowser/filebrowser
< 2.61.1
Published
Mar 05, 2026
Tracked Since
Mar 06, 2026