CVE-2026-29515: MiCode FileExplorer SwiFTP Server Authentication Bypass
MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials. Attackers can send arbitrary username and password combinations to the PASS command handler, which unconditionally grants access and allows listing, reading, writing, and deleting files exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29515?
CVE-2026-29515 is classified as a high severity vulnerability due to its potential for authentication bypass and unauthorized access.
How do I fix CVE-2026-29515?
To mitigate CVE-2026-29515, ensure that you update MiCode FileExplorer to the latest version with patched authentication mechanisms.
What systems are affected by CVE-2026-29515?
CVE-2026-29515 affects MiCode FileExplorer and its embedded SwiFTP server component.
What can attackers do with CVE-2026-29515?
Attackers exploiting CVE-2026-29515 can log in to the FTP server without valid credentials, potentially leading to data breaches.
Is there any workaround for CVE-2026-29515 until a fix is available?
As a temporary workaround for CVE-2026-29515, consider disabling the SwiFTP server component if it is not essential for your operations.