Vulnerability · Published Aug 13, 2026 · Assigned by VulnCheck

CVE-2026-73612File Browser before v2.63.22 Authorization Bypass via Recursive Operations

High 8.1

In plain English

A high-severity authorization bypass via user-controlled key in filebrowser from filebrowser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.

Affected products (as reported)

Vendor	Product	Versions
filebrowser	filebrowser	0 – before 2.63.22

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-77x8-73f4-5485) vendor-advisory
Patch Commit patch
VulnCheck Advisory: File Browser before v2.63.22 Authorization Bypass via Recursive Operations third-party-advisory