CVE-2026-35183

5.4 mediumEPSS 0.2%

Medium (5.4) in ajax30 bravecms. EPSS 0.2% chance of exploitation in the next 30 days.

Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2026-04-06
Modified: 2026-07-24
Record from: the NVD, synced 2026-10-19

Affected

ajax30:bravecms

References

https://github.com/Ajax30/BraveCMS-2.0/security/advisories/GHSA-cpf3-fxwg-cwr3

Check your stack JSON