Loading story…
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source File Browser self-hosted file management application, including CVE-2026-73611, CVE-2026-73612, and CVE-2026-73613. The issues affect File Browser/File Server releases up to 2.63.21 in the broader advisory, while individual fixes were introduced in later versions, including 2.63.22 for the recursive-operations access-control flaw and 2.63.19 as unaffected for the symlink-based deletion issue.
CVE-2026-73612 allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. CVE-2026-73613 enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, CVE-2026-73611 affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-73613 states that the new CVE was received by disclosure@vulncheck.com. The vulnerability affects File Browser versions earlier than 2.63.19.
The CVE record for CVE-2026-73612 was published and updated with affected version information, description, CVSS metrics, CWE mapping, and references. The entry identifies disclosure@vulncheck.com as the source.
CSIRT Italia reported that public proof-of-concept code is available for CVE-2026-73613, CVE-2026-73612, and CVE-2026-73611 in File Browser. It also noted that the vulnerabilities had already been patched by the vendor and advised users to apply the latest security updates.
The vendor patched CVE-2026-73612, an authorization bypass in recursive copy, rename, and delete operations, with version 2.63.22 listed as unaffected. The fix enforces descendant access rules during recursive operations.
The vendor patched the out-of-scope file deletion vulnerability CVE-2026-73613, with version 2.63.19 identified as unaffected. The flaw allowed authenticated users to delete arbitrary files outside their authorized scope via symlink manipulation in the TUS cache eviction mechanism.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple newly disclosed vulnerabilities exposed **arbitrary file write** paths through symlink handling and path validation failures in developer and server-side software. In **Crawl4AI** before `0.8.8`, `CVE-2026-56258` affects screenshot and PDF endpoints by combining weak `output_path` validation, symlink following, and a **TOCTOU** race, allowing unauthenticated remote attackers to write files outside the intended directory and potentially reach code execution. In **Cursor Desktop** before `3.0`, `CVE-2026-50549` lets a malicious agent escape the workspace sandbox by forcing path canonicalization to fail and then abusing an in-workspace symlink to write arbitrary files under the user’s privileges, including paths that could enable later unsandboxed execution. A related pattern also appeared in archive extraction and privileged upload handling. The **extract-zip** package is affected by `CVE-2026-56876`, which fails to validate symlink targets inside ZIP archives, enabling path traversal outside the extraction directory and possible arbitrary file read or write when processing untrusted archives. Separately, **pwnlift** disclosed `CVE-2026-56815` in a privileged upload handler that could be abused for arbitrary file write **as root** through direct symlink following and a TOCTOU race; an initial fix was bypassable before a follow-up patch was merged, while one downstream deployment mitigated exposure by removing the privileged `sudo` entry. Together, the disclosures highlight recurring risk from incomplete path canonicalization, unsafe symlink handling, and containment checks in file-write workflows.
Jul 2, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Two high-severity vulnerabilities in the self-hosted web file manager and WebDAV server **FileRise** exposed organizations to serious compromise. `CVE-2026-33072` affects versions before **3.9.0** and stems from a hardcoded default value for `PERSISTENT_TOKENS_KEY`, which was reused for HMAC token generation, AES configuration encryption, and session-related functions. An unauthenticated attacker could use the shared key to forge upload tokens for arbitrary file uploads to shared folders and decrypt sensitive administrator configuration data, including **OIDC client secrets** and **SMTP passwords**. A second flaw, `CVE-2026-33329`, affects FileRise versions **1.0.1 through before 3.10.0** and allows path traversal through the `resumableIdentifier` parameter in the Resumable.js chunked upload handler. An authenticated user with upload permission could write files to arbitrary server directories, trigger recursive deletion of arbitrary directories during cleanup, and use the behavior as a limited file or directory existence oracle. FileRise addressed the issues in versions **3.9.0** and **3.10.0**, respectively, underscoring the need for administrators to upgrade promptly and review exposed secrets and file integrity.
Jun 29, 2026