Loading vulnerability…
Authorization Bypass in File Browser Recursive Copy, Rename, and Delete Operations
CVE-2026-73612 is a high-severity authorization bypass vulnerability in File Browser before version 2.63.22. The flaw arises because recursive copy, rename, and delete operations validate access only at the allowed parent directory level and fail to enforce path-based access rules on descendant files and subdirectories. As a result, an authenticated user who is permitted to operate on a parent directory can indirectly manipulate restricted child objects contained within it. This breaks rule-based isolation and allows unauthorized operations against files and directories that should remain inaccessible under configured access controls.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to bypass path-based authorization controls and perform unauthorized copy, rename, or deletion actions on restricted descendant files and directories by invoking recursive operations on an allowed parent directory. This can expose protected data through copied content, alter protected filesystem structure through renames, and destroy restricted content through deletion. The primary security impact is loss of confidentiality and integrity for protected filesystem objects.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting which users can perform recursive file-management operations, tightening permissions on parent directories that contain protected descendants, and reviewing access-rule design to avoid placing denied content beneath directories that less-privileged users are allowed to manipulate. Additional monitoring of recursive copy, rename, and delete activity may help detect abuse until the fixed version is deployed.
Patch, then assume compromise.
Upgrade File Browser to version 2.63.22 or later, where descendant access rules are enforced during recursive copy, rename, and delete operations. Ensure that authorization checks are applied to every file and subdirectory affected by a recursive action rather than only to the top-level directory selected by the user.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.