An authorization flaw in the filebrowser direct-upload endpoint allows authenticated users to perform unauthorized recursive directory deletion, potentially leading to significant data loss.

This is an incorrect authorization vulnerability (CWE-863) located in the resourcePostHandler function. It allows an authenticated user with standard Create and Modify permissions to trigger a recursive directory deletion, bypassing intended delete permissions and rule-based access controls.

The exploitation of this flaw can lead to severe data loss and service disruption, as an authenticated attacker can delete critical directories within their scope that they are not authorized to remove. With a CVSS score of 8.1, the high impact on data integrity and system availability necessitates immediate attention, particularly in multi-user environments where standard users could inadvertently or maliciously destroy shared resources.

Immediate Action: As no patch is currently available, administrators must restrict access to the direct-upload endpoint or limit user permissions to the absolute minimum necessary for their roles until a vendor fix is released.

Proactive Monitoring: Monitor server access logs for unusual POST requests to the direct-upload endpoint, specifically those utilizing the override=true parameter, and track any unexpected directory removal events.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and block POST requests containing the override=true query parameter if such traffic is not required for legitimate business operations.

Public Exploit Available: No (exploit_available: false)

Given the lack of a current vendor patch, organizations should prioritize limiting user privileges to reduce the attack surface. Administrators are advised to monitor the official File Browser security advisories closely for the release of a patched version and apply it immediately upon availability to mitigate the risk of unauthorized data destruction.