Description

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T12:17:25.897Z",
  "pubdate": "2026-08-13T12:17:25.897Z",
  "executiveSummary": "File Browser before v2.63.22 suffers from an access control bypass vulnerability affecting recursive copy, rename, and delete operations.\nThe vulnerability allows authenticated users to bypass path-based access control rules, violating confidentiality and integrity boundaries.\nThe affected product is File Browser in versions prior to v2.63.22.\nRisk implications include unauthorized modification, destruction, or duplication of restricted filesystem descendants by leveraging parent-level access.\nAttacker capabilities require authenticated access to the application and the ability to issue recursive file management operations targeting allowed parent directories.\nNo specific advanced privileges beyond standard authentication are stated as required to execute the attack flow, provided the user can interact with permitted parent paths.",
  "technicalDetails": "The root cause of the vulnerability is the failure of File Browser to validate path-based access rules for descendant files and directories during recursive operations.\nSpecifically, when performing recursive copy, rename, and delete operations, the underlying logic omits security checks against individual descendant nodes that may be explicitly denied by access rules.\nThe vulnerable components are the file management subsystems handling recursive actions such as copy, rename, and delete within File Browser prior to version v2.63.22.\nAuthentication requirements dictate that the attacker must be an authenticated user within the system to initiate file operations.\nNetwork exposure is contingent on the standard accessibility of the File Browser web interface.\nThe step-by-step exploitation method occurs as follows: first, the attacker identifies a file or directory path that is restricted by rule-based access controls. Second, the attacker locates a parent directory that they possess legitimate authorization to access. Third, the attacker initiates a recursive operation—such as a copy, rename, or delete—targeting the allowed parent directory in a manner that encompasses the denied descendant. Finally, because the application fails to validate access rules for descendants during the recursion, the operation successfully processes the restricted target, thereby bypassing confidentiality and integrity controls.\nThe post-exploitation impact includes unauthorized data exfiltration via unauthorized copying, destruction of sensitive data through unauthorized deletion, or arbitrary restructuring of restricted resources via unauthorized renaming."
}