CVE-2026-73612 in File Browser is a recursive operation authorization bypass: when users initiate delete, rename, or copy operations on a directory, the system validates permission only at the entry point and assumes that authorization extends to all descendants. This means a user with access to a parent directory can reach files they were explicitly denied access to, simply by traversing through an allowed container.
This is not an isolated flaw. The same pattern — container permission checked, contents not — has appeared in OwnCloud (CVE-2018-5732), Nextcloud (CVE-2020-8253), and multiple embedded NAS firmwares, all carrying CVSS 7 or higher. The fix in v2.63.22 adds descendant validation during traversal, but this introduces its own edge cases around symlink handling, cycle detection, and permission inheritance ordering that will require monitoring.
For defenders: audit your web-based file management tools for this specific interaction surface — test whether a permitted operation on an allowed container can reach denied files. This is distinct from testing direct file access and requires constructing a scenario where the attack path runs through an authorized parent. The vulnerability class scales with the number of files managed: a single recursive operation can exfiltrate every file the system has rules protecting, making the blast radius proportional to deployment size rather than attacker sophistication.
The deeper pattern to watch: hierarchical access control systems routinely encode an implicit assumption that container authorization implies descendant authorization. This assumption is made so early in design that it becomes invisible during review and testing. When recursive capabilities are added as feature enhancements (rather than being part of the original architecture), the security model frequently fails to travel with them. Treat recursive operations as inherently high-blast-radius operations in threat modeling — they are force multipliers on permission errors.