CVE-2026-35183
High
Description
Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is located in app/Http/Controllers/Dashboard/ArticleController.php within the deleteImage method. The endpoint accepts a filename from the URL but does not verify ownership. This allows an authenticated user with edit permissions to delete images attached to articles owned by other users. This vulnerability is fixed in 2.0.6.
SeverityHigh
CVSS7.1
Exploit probability—
ProductAjax30 Bravecms
PublishedApr 6, 2026
First seenApr 6, 2026
How to fix
Update
- ajax30 bravecms2.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ajax30 bravecms | 2.0.0 ≤ v < 2.0.6 | 2.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.