CVE-2026-35183
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An IDOR vulnerability in the article image deletion feature in Brave CMS prior to 2.0.6. The deleteImage method in ArticleController.php accepts a filename from the URL without ownership verification, allowing an authenticated user with edit permissions to delete images attached to other users' articles.
Risk Assessment
An authenticated attacker can delete images belonging to other users, potentially causing data loss or service disruption.
Recommendation
Update Brave CMS to version 2.0.6 or later.
Other vulnerabilities in Brave CMS
See all- CVE-2026-41576High
Brave CMS prior to commit 6c56603 had a publicly accessible contact form, allowing for the injection of unsafe HTML into email content. User-supplied message text was processed by the nl2br() function, which did not sanitize HTML, enabling attackers to create phishing interfaces in emails sent to the administrator.
- CVE-2026-41524High
Brave CMS prior to commit 6c56603 stored page and article body content entered by editor-role users through CKEditor verbatim in the database. As a result, any JavaScript or HTML injected by them was permanently stored and executed in every visitor's browser upon page load.
- CVE-2026-35182High
In Brave CMS prior to 2.0.6, the update role endpoint lacks authorization checks, allowing any authenticated user to change roles and become Super Admin.
Original NVD description (English source)
Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.