Is CVE-2026-29188 actively exploited?

No active exploitation of CVE-2026-29188 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-29188 be exploited remotely?

Yes. CVE-2026-29188 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-29188?

CVE-2026-29188 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-29188

HIGH

CVE-2026-29188

CWE-284Published: March 5, 2026· Updated: Mar 10, 2026

8.1

CVSS v3.1

EPSS:0.06%probability of exploitation in 30 daysPercentile:18.3th

Official Description

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected. This issue has been patched in version 2.61.1.

NVD Source

Technical Analysis

CVE-2026-29188 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.