CVE-2026-73612 in File Browser
Summary
by MITRE • 08/13/2026
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability exists in File Browser versions prior to 2.63.22 where the application fails to properly validate access rules when performing recursive operations on directories and their contents. The flaw stems from inadequate enforcement of path-based access controls during copy, rename, and delete actions that traverse directory hierarchies. When users with appropriate permissions on a parent directory attempt recursive operations, the system incorrectly allows access to descendant files that should be restricted based on individual access rules. This represents a classic privilege escalation vulnerability where authenticated users can bypass security boundaries that are meant to protect sensitive data through improper access control validation.
The technical implementation of this flaw occurs at the recursive operation level within File Browser's permission checking mechanism. During copy, rename, or delete operations that traverse multiple directory levels, the system validates access permissions only against the immediate parent directory rather than recursively verifying that all descendant paths maintain proper authorization. This creates a gap in the access control model where the security boundary is effectively bypassed when users can operate on parent directories containing restricted child files. The vulnerability is particularly concerning because it operates at the filesystem abstraction layer, allowing attackers to manipulate data across multiple permission boundaries without triggering appropriate security alerts.
The operational impact of this vulnerability extends beyond simple unauthorized file access to encompass potential data integrity and confidentiality breaches. An attacker with access to a parent directory can effectively gain read, write, or delete capabilities on all descendant files regardless of individual access rules that should have prevented such actions. This creates a scenario where sensitive documents, configuration files, or system resources can be compromised through seemingly legitimate administrative operations. The vulnerability undermines the fundamental security principle of least privilege by allowing users to perform actions that should be restricted based on their explicit authorization levels.
Organizations utilizing File Browser versions prior to 2.63.22 face significant risk of data exposure and potential regulatory violations, particularly in environments requiring strict access control policies. The vulnerability aligns with CWE-284 which addresses improper access control issues, specifically targeting weak enforcement mechanisms in recursive file operations. From an attack perspective, this flaw maps to ATT&CK technique T1078 for valid accounts and T1566 for credential access through legitimate system interactions. The remediation approach requires immediate patching to version 2.63.22 or later, along with comprehensive review of existing access control policies to ensure proper implementation of recursive permission validation. Additionally, organizations should implement monitoring for unauthorized recursive operations and conduct regular audits of directory permissions to identify potential exploitation attempts. The fix addresses the core issue by implementing proper recursive access validation that checks all path components during copy, rename, and delete operations, ensuring that individual file access rules are consistently enforced throughout the entire directory hierarchy.