CVE-2026-72836

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19

Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for case-insensitivity during self-registration home directory ownership checks. Consequently, two users registering with names that differ only by case (e.g., CaseVictim and casevictim) are treated as distinct accounts but are mapped to the same physical home directory. This occurs because the scope-ownership check performs an exact case-sensitive string comparison. An attacker can register a similar username to read, overwrite, or delete files belonging to another account via authenticated HTTP endpoints without requiring victim interaction.

Recommendations Update to version 2.63.19 or later.