CVE-2026-29515: Xiaomi Fileexplorer Auth Bypass Flaw

CVE-2026-29515 Overview

CVE-2026-29515 is an authentication bypass vulnerability in MiCode FileExplorer, an open source file management application maintained by Xiaomi. The flaw resides in the embedded SwiFTP File Transfer Protocol (FTP) server component. The PASS command handler unconditionally grants access to any client, regardless of the supplied username or password. Network-positioned attackers can list, read, write, and delete every file exposed by the FTP server. The MiCode/Explorer open source project has reached end-of-life status, so no upstream fix will be issued. The vulnerability is classified under [CWE-303] (Incorrect Implementation of Authentication Algorithm) and [CWE-862] (Missing Authorization).

Critical Impact
Unauthenticated network attackers gain full read and write access to files exposed by the SwiFTP server, enabling data theft, tampering, and the introduction of malicious content into user-accessible storage.

Affected Products

Xiaomi FileExplorer (MiCode/FileExplorer open source project)
Embedded SwiFTP FTP server component
All versions — project is end-of-life with no patch available

Discovery Timeline

2026-03-11 - CVE-2026-29515 published to the National Vulnerability Database
2026-05-07 - Last updated in NVD database

Technical Details for CVE-2026-29515

Vulnerability Analysis

MiCode FileExplorer embeds SwiFTP, a lightweight FTP server, to expose device files to remote clients over the network. FTP authentication is normally enforced by validating the credentials supplied through the USER and PASS commands against a configured username and password. In the vulnerable build, the PASS command handler does not compare the submitted password against the configured value. Instead, it returns a success response for every authentication attempt and transitions the session into an authenticated state.

Once inside the session, the attacker has the same privileges as a legitimate user. They can issue LIST, RETR, STOR, DELE, and RNFR/RNTO commands against any path the FTP server exposes. Because the project is end-of-life, no upstream patch is forthcoming, and downstream users must remove or replace the component.

Root Cause

The defect is a missing authentication check in the PASS command handler of the embedded SwiFTP server. The handler unconditionally returns the FTP 230 Login successful response without invoking any credential comparison routine. This combines an incorrect implementation of the authentication algorithm [CWE-303] with missing authorization [CWE-862] on the file operations that follow.

Attack Vector

The attack is fully network-based and requires no privileges or user interaction. An attacker on the same network as a device running FileExplorer with the FTP server enabled connects to the listening TCP port. The attacker sends any USER value followed by any PASS value. The server accepts the session and exposes the full file tree advertised by the FTP root. The vulnerability is described in the VulnCheck Security Advisory and the source resides in the GitHub FileExplorer Project.

No verified public proof-of-concept code is available; the exploitation flow is documented in prose by the advisory.

Detection Methods for CVE-2026-29515

Indicators of Compromise

Inbound TCP connections to the default SwiFTP listening port from unexpected hosts on the local network.
FTP session logs showing successful 230 responses immediately after arbitrary USER and PASS values.
Unexpected file creation, modification, or deletion events on directories exposed by FileExplorer.
Outbound transfers of large archives or media files from a mobile device running FileExplorer.

Detection Strategies

Monitor wireless and segmented networks for FTP traffic originating from or destined to user devices running FileExplorer.
Inspect FTP command streams for PASS commands followed by 230 responses without prior valid USER registration in inventory.
Correlate file integrity changes on shared mobile storage with concurrent FTP session activity.

Monitoring Recommendations

Capture and retain NetFlow or packet metadata for TCP/21 and any non-standard FTP ports on user network segments.
Alert on any device exposing an FTP service that is not part of the approved server inventory.
Track removal of the MiCode/FileExplorer package across managed mobile fleets to confirm remediation progress.

How to Mitigate CVE-2026-29515

Immediate Actions Required

Uninstall MiCode FileExplorer from all devices, as the project is end-of-life and no patched build will be released.
Disable any "FTP server" or "remote file access" feature inside FileExplorer if uninstallation is not immediately possible.
Restrict device network access to trusted Wi-Fi only, and block inbound FTP on guest and untrusted segments.
Audit storage exposed by the application for unauthorized modifications or deletions.

Patch Information

No patch is available. The MiCode/Explorer open source project has reached end-of-life status, and the vendor will not release a fix. Refer to the VulnCheck Security Advisory and the GitHub FileExplorer Project for current status. Migrate to an actively maintained file manager that does not embed SwiFTP.

Workarounds

Replace FileExplorer with a maintained file management application that ships an authenticated, current FTP or SFTP implementation.
If the application must remain installed, ensure its FTP server toggle is disabled and verify no listener is bound at startup.
Place affected devices behind a host-based firewall rule that blocks inbound connections on FTP ports.
Use SFTP or HTTPS-based file sharing tools as a permanent substitute for in-app FTP services.

bash

# Configuration example: block inbound FTP to mobile device subnets
# Example iptables rule on a Linux gateway protecting a user VLAN
iptables -A FORWARD -p tcp --dport 21 -d 192.0.2.0/24 -j DROP
iptables -A FORWARD -p tcp --dport 2121 -d 192.0.2.0/24 -j DROP