File Browser CVE-2026-73612

Exploitation requires a valid authenticated File Browser user account (CVSS PR:L - any registered, non-anonymous user). The vulnerable condition is a deployment where path-based access rules deny a user access to one or more subdirectories while granting access to an ancestor directory - the access rule isolation model must be in use. The bypass is triggered exclusively through recursive bulk operations: copy, rename, or delete initiated on the permitted parent path. Limiting factors: anonymous/unauthenticated access cannot exploit this; single-user deployments without access-rule segmentation have no meaningful isolation to bypass; and the attacker's reach is bounded by whatever parent-directory permission they legitimately hold - they cannot access paths entirely outside their scope. Default out-of-the-box installations without configured access rules are not meaningfully impacted.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is well-calibrated: the attack is network-reachable, requires no special conditions, and demands only a standard authenticated session - meaning any registered user is a potential threat actor, not just administrators. The high confidentiality and integrity scores are accurate, as successful exploitation grants unrestricted read and write access to nominally restricted files. No EPSS score was supplied, and the vulnerability is not listed in CISA KEV, so widespread in-the-wild exploitation is not confirmed. However, the low exploitation barrier - no tooling or privilege escalation required - makes this a realistic threat for any multi-tenant or role-segregated File Browser deployment regardless of scale. Organizations using File Browser to enforce data isolation between teams or users should treat this as urgent patching priority; the absence of a public POC tempers but does not eliminate urgency given the trivial attack path.

An authenticated user with access to /shared/ but explicitly denied access to /shared/confidential/ initiates a recursive copy of /shared/ to a destination they control. Because the authorization engine only validates the top-level /shared/ path and not each descendant, the copy operation proceeds over /shared/confidential/, delivering the restricted files to the attacker's accessible destination. No public POC exists, but the attack requires only standard File Browser UI interactions or API calls available to any authenticated session.