A path traversal flaw in the destination parameter of the resourcePatchHandler allows an authenticated user with Create or Rename permissions to write or move files into any path protected by administrator‑configured deny rules. The flaw occurs because the validation of access rules precedes path normalization, letting malicious path sequences such as ".." be resolved to a different effective location. As a result, attackers can place files in directories that should be off‑limits within their assigned scope, potentially subverting security policies without breaching the user’s base directory.

The vulnerability affects File Browser services of the filebrowser:filebrowser product with version 2.61.2 and earlier. The product is an open‑source web‑based file manager that supports uploading, deleting, previewing, renaming and editing files within a configured directory.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The flaw is not listed in the CISA KEV catalog, giving no evidence of active exploitation in the wild. An attacker must be authenticated and possess either Create or Rename permissions to exploit the issue, and the attack vector is remote through the web interface via an HTTP PATCH request with a crafted destination parameter. The flaw cannot be used to escape the user’s BasePathFs scope or read from restricted locations, but it does enable unauthorized writes within the user’s permitted area.