The vulnerability arises from an inadequate authorization check in File Browser’s direct‑upload endpoint. When a user issues a POST request to a directory with the query parameter ?override=true, the upload fails inside writeFile because a directory cannot be opened for writing. The subsequent failure‑cleanup routine incorrectly calls Fs.RemoveAll on the requested path, which recursively deletes the entire directory tree. Because this cleanup path bypasses both the Delete permission check and the rule‑denied hierarchy walk normally applied to deletion operations, an authenticated non‑administrator holding only they are not authorized to remove, including files that the access rules forbid. The flaw is categorized as an insufficient authorization error (CWE‑863).

File Browser versions from 2.5.0 through 2.63.23 are affected. The CNA identifies the product as filebrowser:filebrowser, and the generic CPE cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:* includes all releases in that range. No patched version is currently available, so vulnerable installations remain susceptible.

The CVSS score of 7.2 indicates a moderate‑to‑high severity. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence yet of widespread exploitation. An attacker must possess a valid authenticated session for a non‑administrator user with Create and Modify permissions; beyond the user’s scoped directories the vulnerability does not permit broader deletion. Nonetheless, deleting entire directory trees within a user's scope can cause serious data multi‑tenant deployments.