Patched File Browser flaws enable auth bypass and arbitrary file deletion

Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source File Browser self-hosted file management application, including CVE-2026-73611, CVE-2026-73612, and CVE-2026-73613. The issues affect File Browser/File Server releases up to 2.63.21 in the broader advisory, while individual fixes were introduced in later versions, including 2.63.22 for the recursive-operations access-control flaw and 2.63.19 as unaffected for the symlink-based deletion issue.

CVE-2026-73612 allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. CVE-2026-73613 enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, CVE-2026-73611 affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.