CVE-2026-73612: Filebrowser

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.

Affected products

• Filebrowser Filebrowser: before 2.63.22 (fixed in 2.63.22)

Published 2026-08-13. Last modified 2026-09-08.