Executive brief
Brave CMS is an open-source content management system used to build and manage websites. A security flaw in the article management feature allows any user with basic editing permissions to delete images belonging to other users' articles. This could lead to unauthorized data loss and disruption of website content by malicious or disgruntled users.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Brave CMS within the `deleteImage` method of `app/Http/Controllers/Dashboard/ArticleController.php`. The application processes image deletion requests via a URL endpoint that accepts a filename and article ID but fails to verify if the authenticated user owns the target article. An attacker with standard 'author' or 'editor' privileges can exploit this by sending a crafted POST request to `/dashboard/articles/delete-image/{id}/{filename}` to delete arbitrary images from the server's storage. The vulnerability is addressed in version 2.0.6 by implementing ownership checks and filename validation.
Affected products
- Ajax30 BraveCMS-2.0 2.0.0 to 2.0.5
Timeline
- 2026-04-01: advisory: GitHub security advisory published by vendor
- 2026-04-06: disclosed: CVE published to NVD
- 2026-04-06: patched: Fix released in version 2.0.6