CVE-2026-73612
HighCVSS 8.1Summary
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.
Risk Assessment
Risk of confidentiality and integrity breach by bypassing path-based access controls, potentially leading to unauthorized file access.
Recommendation
Upgrade File Browser to version v2.63.22 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.