# CVE-2026-73612: File Browser path-based access control bypass in recursive operations

Source: https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73612 · Severity: high · CVSS 8.1 · Published 2026-08-13

File Browser is a file management web application used to browse and manipulate files on a server. The software fails to validate access rules when performing recursive copy, rename, and delete operations on directory trees. Authenticated users can exploit this to read, move, or destroy files that should be denied by the administrator's access rules, compromising both data confidentiality and integrity.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser).

## Quick answers

**Is CVE-2026-73612 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73612 being exploited in the wild.

**How severe is CVE-2026-73612?** High severity, with a CVSS score of 8.1, published 13 August 2026.

**Which products and versions are affected?** File Browser before v2.63.22.

**Is there a fix for CVE-2026-73612?** A patch was published on 2026-07-27: Fixed in v2.63.22 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73612 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73612?** Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path-based access control bypass in File Browser's recursive file operations. The root cause is that the copy, rename, and delete handlers (in http/resource.go) validate access rules only at the operation's root path, then proceed to recursively process the entire directory tree without re-checking rules on descendants. An attacker with ordinary file-operation permission on a parent directory can exploit this by operating on that parent even if child paths are denied by rules, effectively bypassing the rule-based isolation. The attack requires authentication and low privileges (a non-admin user with create/rename/delete permission). Fix: v2.63.22 enforces rules on all paths in the source tree and destination before performing any operation, returning 403 if any path is denied.

## Affected products

- File Browser File Browser before v2.63.22

## Timeline

- 2026-07-27: disclosed: Fix commit published
- 2026-07-27: patched: Fixed in v2.63.22
- 2026-08-13: advisory: CVE-2026-73612 published

## References

- [https://github.com/filebrowser/filebrowser/commit/72faf6dd3c85628e332d3e567124b86708ce2695](https://github.com/filebrowser/filebrowser/commit/72faf6dd3c85628e332d3e567124b86708ce2695)
- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-77x8-73f4-5485](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-77x8-73f4-5485)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser JWT expiration bypass in proxy authentication](https://junglewise.ai/threats/cve-2026-73611-file-browser-jwt-expiration-bypass-in-proxy-authentication)