Read the docs
TI-2026-51062 Aliases CVE-2026-72836GHSA-f37p-wpgx-m9mr

FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass

Priority HIGH 75CWE-178Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Fixed filebrowser (filebrowser): 2.63.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
filebrowserfilebrowserbefore 2.63.192.63.19Patch availableCNA
  • filebrowser Vendorfilebrowser Affected before 2.63.19 Fixed in 2.63.19 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*——filebrowser
  • cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:* Versions — — ·filebrowser

Remediation

  • Fix · CNA filebrowser (filebrowser) Fixed in 2.63.19

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    filebrowser 2.63.19

    3 records Highest priority Priority HIGH 1 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-51064 FileBrowser before 2.63.19 Disk Exhaustion via TUS UploadPriority LOW 32
    • TI-2026-51060 filebrowser before 2.63.19 Permission Bypass via checksumPriority LOW 24
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-72836
  2. 2026-10-03 Alias added: GHSA-f37p-wpgx-m9mr

References

Patch 1

Advisory 1

  • TI-2026-25251 File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin CVSS 4.0CRITICAL 10.0
  • TI-2026-51065 filebrowser through 2.63.16 Privilege Escalation via Signup CVSS 4.0CRITICAL 9.3
  • TI-2026-39018 File Browser: Authentication Bypass via Proxy Auth Header Forgery CVSS 3.1CRITICAL 9.1
  • TI-2026-39017 File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) CVSS 4.0CRITICAL 9.3
  • TI-2026-23305 File Browser: TUS Delete Endpoint Bypasses Delete Permission Check CVSS 3.1CRITICAL 9.1
  • TI-2026-26777 File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution CVSS 3.1CRITICAL 9.8
See all 64 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences