CVE-2026-29515 is a critical flaw (CVSS 9.8) in MiCode FileExplorer. Its embedded SwiFTP server accepts any username and password, so anyone on the network can list, read, write and delete files it exposes. The project has reached end of life, so there is no fix to wait for. Stop using the feature.
What's affected
The NVD record names the MiCode FileExplorer app, the community edition of the MIUI file manager, and its embedded SwiFTP server component. No version range is given. The VulnCheck advisory and NVD both say the open source project has reached end-of-life status, which means no patched release should be expected.
You are exposed only while the app's FTP server is running and reachable on a network you share with others.
How to check if you're exposed
On Android devices, check whether the app is installed from the package list or your mobile device management console. Look for the name MiCode FileExplorer or the MIUI file manager community edition. Then check whether the FTP server function is turned on in the app. From another machine on the same network, a scan for an open FTP port on the device's address will show whether one is listening. Public Wi-Fi is the riskiest place to leave it running.
What to do now
- Turn off the FTP server in the app, and do not start it on shared or public networks.
- Replace the app with a maintained file manager, since the open source project is end of life.
- Remove the app from managed devices and block it in your device policy if you run mobile device management.
- Review any files that were shared through the FTP feature, and assume they were readable and changeable by others on that network.
- Use authenticated transfer methods, such as SFTP with keys, from maintained software.
Why it matters
The record files this under CWE-303, incorrect implementation of an authentication algorithm, and CWE-862, missing authorization. The VulnCheck advisory says the password command handler grants access unconditionally. That means the login check does nothing, and the server treats every visitor as an authorised user.
FTP servers on phones are designed for convenience on a home network, which is exactly where nobody expects an attacker. With no fix coming, the only safe choice is to stop using the feature or replace the app. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog.
Quick check
Will there be a patch?
The advisory says the project has reached end of life, so you should not expect one.
Am I exposed if the FTP server is switched off?
The flaw is in the FTP server component, so it matters when that server is running.
Sources
Last reviewed: 19 October 2026.
