The root cause of CVE-2026-73509 is a design-level assumption failure rather than a simple implementation oversight. The handler that processes file rename operations validates the directory component through user.JoinPath but treats the filename component (SrcName) as pre-validated, creating a blind spot where path traversal can escape user isolation boundaries. This is the pattern: "I've already authorized the parent directory, so anything inside it is authorized." It's a common but dangerous cognitive shortcut in file operation handlers — the validations are separated in the codebase rather than composed into a single path-building operation, so a developer adding checkRelativePath to one operand (NewName) can easily miss applying the same validation to a parallel operand (SrcName).
The "cross-user file integrity loss" framing is the most consequential detail. This isn't self-service traversal within a user's own storage pool — the path normalization escapes user isolation boundaries entirely. This suggests the permission model is layered on top of a shared filesystem backend rather than user-namespaced containers. If that's the case, the fix in 4.2.4 may address only the path traversal vector but leave the underlying architectural assumption intact: that path normalization will respect user isolation boundaries at the filesystem layer. The critical question is whether the filesystem resolution layer itself has been audited for path normalization escaping user isolation when authorized directories overlap on disk.
You should audit parallel handlers (delete, move, copy operations) immediately — they were likely built on the same directory-trust / filename-unvalidated pattern, and if so, they contain equivalent traversal vectors. The availability impact qualifier warrants scrutiny: if rename operations hold filesystem locks or can corrupt directory entries under certain traversal conditions, repeated exploitation could extend beyond individual file access into broader filesystem state degradation. The fix is correct at the operand level, but it treats the symptom while the structural problem — handler-layer authorization over shared storage — remains unexamined.