What’s Vulnerable › Vulnerabilities

CVE-2026-29515: MiCode FileExplorer SwiFTP Server Authentication Bypass

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-11 · updated 2026-07-14
• Weakness: CWE-303

Description

MiCode FileExplorer contains an authentication bypass vulnerability in the embedded SwiFTP FTP server component that allows network attackers to log in without valid credentials. Attackers can send arbitrary username and password combinations to the PASS command handler, which unconditionally grants access and allows listing, reading, writing, and deleting files exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status.

Affected products

• MiCode FileExplorer: all versions

References

• https://github.com/MiCode/FileExplorer
• https://www.vulncheck.com/advisories/micode-fileexplorer-swiftp-server-authentication-bypass

Get alerted when CVE-2026-29515 or the next vulnerability affects your stack