CVE-2026-35183
Brave CMS has an Insecure Direct Object Reference in Article Image Deletion
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.1EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
06 abr 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Productos afectados
Ajax30 · BraveCMS-2.0¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →