Description
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating on their allowed parent directory, defeating rule-based isolation for confidentiality and integrity.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| filebrowser | filebrowser | < 2.63.22 | 2.63.22 |
References
- GitHub Security Advisory (GHSA-77x8-73f4-5485) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: File Browser before v2.63.22 Authorization Bypass via Recursive Operations third-party-advisory