CVE-2026-62685

Deferred Deferred - Pending Action

Path Traversal in File Browser via Username Normalization

Publication date: 2026-07-15

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directory without checking whether the resulting scope is already taken, allowing a second registrant to gain full read and write access to another user's files. This issue is fixed in version 2.63.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-20

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-62685

EUVD

EUVD-2026-44708

Affected Vendors & Products

Vendor	Product	Version / Range
filebrowser	filebrowser	to 2.63.17 (exc)
filebrowser	filebrowser	2.63.17

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-647	The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
CWE-706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in FileBrowser versions before 2.63.17 allows unauthorized access to user home directories due to flawed username normalization. When self-registration and automatic home-directory creation are enabled, distinct usernames like team/one, team one, and team-one all normalize to team-one, sharing the same home directory. An attacker can register a colliding username to access and modify another user's files, bypassing per-user isolation.

Detection Guidance

Check if FileBrowser is running version 2.63.16 or earlier. Inspect the configuration for Signup=true and CreateUserDir=true settings. Look for multiple user accounts sharing the same home directory path due to username normalization issues.

Impact Analysis

This vulnerability allows an attacker to access, modify, or delete files belonging to another user by registering a username that normalizes to an existing user's home directory. It bypasses per-user isolation, potentially leading to data theft, corruption, or unauthorized file manipulation. Exploitation requires the administrator to have enabled both Signup and CreateUserDir settings.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade FileBrowser to version 2.63.17 or later immediately. Disable self-registration (Signup) or automatic home directory creation (CreateUserDir) if not required. Review user directories for unauthorized access and revoke any shared permissions.

Hi! I’m here to help you understand CVE-2026-62685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70