The vulnerability identified as CVE-2026-73612 affects File Browser before version 2.63.22. It arises because the software fails to validate access rules for descendant files and directories during recursive operations such as copy, rename, and delete. Authenticated users can exploit this flaw to bypass path-based access controls by performing operations on parent directories that are allowed, thereby indirectly copying, renaming, or deleting files that should be denied. This defeats rule-based isolation mechanisms intended to protect file confidentiality and integrity. The CVSS 3.1 score is 8.1, indicating a high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacting confidentiality and integrity but not availability.

Successful exploitation allows authenticated users to bypass path-based access controls and manipulate files that should be inaccessible, potentially leading to unauthorized disclosure or modification of sensitive files. This compromises the confidentiality and integrity of the affected system's data. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict authenticated user permissions to minimize exposure to this vulnerability.