Go/github.com/filebrowser/filebrowser/v2 CVE-2026-29188: critical 9.1, EPSS 0.62%

File Browser's TUS Delete Endpoint Bypasses Delete Permission Check

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.61.1 or later.

go get github.com/filebrowser/filebrowser/v2@v2.61.1

Affected

Fixed versions

Sources

• osv: GHSA-79pf-vx4x-7jmm
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm
• https://nvd.nist.gov/vuln/detail/CVE-2026-29188
• https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f
• https://github.com/filebrowser/filebrowser
• https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1

CVE-2026-29188 · published 2026-03-04T22:38:01Z · modified 2026-03-23T04:56:25.255808965Z · JSON