Authorization Bypass in File Browser via Recursive Operations

File Browser versions prior to 2.63.22 are affected by an authorization bypass vulnerability stemming from a flaw in how the application validates access rules during recursive file operations. Authenticated users with limited permissions to a parent directory can circumvent access control rules to perform unauthorized actions on descendant files or directories. The vulnerability manifests during copy, rename, and delete operations, where the system fails to verify that the target files or destination paths adhere to the organization's defined access constraints. This allows a low-privileged user to impact the confidentiality and integrity of restricted files by initiating recursive commands from a parent folder for which they have valid access. This issue is tracked as CVE-2026-73612 and carries a CVSS base score of 8.1.

Impact

Successful exploitation allows authenticated users to bypass path-based access controls, potentially leading to unauthorized data exfiltration (via copy), unauthorized data destruction (via delete), or directory structure manipulation (via rename). This can result in significant loss of confidentiality and integrity for files that were intended to be protected by administrative or user-based access rules.

Recommendation

1. Upgrade File Browser installations to version 2.63.22 or later to remediate the authorization logic flaw identified in CVE-2026-73612.
2. Audit current access control rules within the File Browser environment to identify any over-privileged user roles that could facilitate this attack.
3. Monitor file management logs for anomalous patterns of recursive copy, move, or delete operations originating from low-privileged accounts or unexpected directory paths.