Description

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-14T12:16:47.060Z",
  "pubdate": "2026-08-14T12:16:47.060Z",
  "executiveSummary": "FileBrowser before 2.63.19 contains an access control vulnerability stemming from insufficient handling of case-insensitive filesystems during home directory ownership checks in the self-registration workflow. When the Signup and CreateUserDir features are enabled and FileBrowser operates on a case-insensitive filesystem such as Windows/NTFS, the application fails to correctly account for case variations when resolving user home directories. Consequently, distinct user accounts with usernames differing only by letter case map to the exact same physical directory on disk due to case-insensitive name resolution.\nAn unauthenticated attacker can exploit this flaw by registering two separate accounts with conflicting case variations to target a victim's user directory. Through authenticated HTTP endpoints, the attacker can then read, overwrite, and delete files belonging to another user account without requiring prior victim interaction or elevated privileges.\nThe risk implication is critical, as it leads to complete cross-user data access, unauthorized file modification, and data destruction within multi-tenant or self-registration deployments on vulnerable operating systems.",
  "technicalDetails": "The root cause of the vulnerability resides in the scope-ownership verification logic implemented during the self-registration and home directory creation process within FileBrowser. When a new user registers through the self-registration functionality with Signup and CreateUserDir enabled, the application creates a dedicated physical home directory for the account.\nOn case-insensitive filesystems like Windows/NTFS, operating system file path resolution treats strings such as CaseVictim and casevictim as identical paths. However, the application persists usernames as distinct database records and evaluates scope ownership by performing an exact, case-sensitive string comparison against the persisted scope configuration. Because the case-sensitive check fails to recognize that the target filesystem collapses case-differing paths into a single physical location, the system allows the creation of a second account that maps to an already claimed physical scope.\nThe attack flow proceeds as follows: First, the attacker identifies a FileBrowser instance running on a case-insensitive filesystem with self-registration enabled. Second, the attacker determines or guesses an existing victim username (e.g., VictimUser). Third, the attacker registers a new account using a case-variant username (e.g., victimuser). Because the underlying filesystem resolves both user directories to the same physical path, the newly registered account gains direct access to the files within the victim's directory.\nLeveraging authenticated HTTP endpoints exposed by FileBrowser, the attacker can interact with the shared directory scope, enabling them to read sensitive files, overwrite existing data, or delete arbitrary files belonging to the original account holder. The vulnerability requires no prior authentication to initiate the registration of the colliding account, no victim interaction, and only standard user privileges obtained via self-registration."
}