Executive brief
File Browser is a file management web application used to browse and manipulate files on a server. The software fails to validate access rules when performing recursive copy, rename, and delete operations on directory trees. Authenticated users can exploit this to read, move, or destroy files that should be denied by the administrator's access rules, compromising both data confidentiality and integrity.
Technical details
The vulnerability is a path-based access control bypass in File Browser's recursive file operations. The root cause is that the copy, rename, and delete handlers (in http/resource.go) validate access rules only at the operation's root path, then proceed to recursively process the entire directory tree without re-checking rules on descendants. An attacker with ordinary file-operation permission on a parent directory can exploit this by operating on that parent even if child paths are denied by rules, effectively bypassing the rule-based isolation. The attack requires authentication and low privileges (a non-admin user with create/rename/delete permission). Fix: v2.63.22 enforces rules on all paths in the source tree and destination before performing any operation, returning 403 if any path is denied.
Affected products
- File Browser File Browser before v2.63.22
Timeline
- 2026-07-27: disclosed: Fix commit published
- 2026-07-27: patched: Fixed in v2.63.22
- 2026-08-13: advisory: CVE-2026-73612 published