CVE-2026-72836
Received Received - Intake

FileBrowser Case-Insensitive Filesystem Ownership Bypass

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72836
EUVD
EUVD-2026-58650

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser to 2.63.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-178 The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FileBrowser before 2.63.19 has a flaw where it doesn't handle case-insensitive filesystems properly during user registration. If Signup and CreateUserDir are enabled and the root is on a case-insensitive filesystem like Windows/NTFS, two usernames differing only in case (e.g., User1 and user1) are stored as separate accounts but point to the same home directory. This allows a second registrant to access, modify, or delete files of another account through authenticated HTTP endpoints without needing the victim's interaction.

Detection Guidance

Check FileBrowser version with: filebrowser version. If version is before 2.63.19, the system is vulnerable. Inspect filesystem type hosting FileBrowser root (e.g., NTFS on Windows). Test for duplicate accounts differing only in case by attempting to register similar usernames and verifying if they access the same home directory.

Impact Analysis

This vulnerability allows an attacker to read, overwrite, or delete files belonging to another user without authentication or victim interaction. It can lead to data loss, unauthorized data access, or complete account compromise if the attacker manipulates files in the shared home directory. The impact is severe due to the high CVSS score of 9.2.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal penalties due to loss of data integrity and availability.

Mitigation Strategies

Upgrade FileBrowser to version 2.63.19 or later immediately. Disable Signup and CreateUserDir features if not required. Ensure filesystem hosting FileBrowser root is case-sensitive or enforce case-sensitive username handling in configuration. Monitor for unauthorized file access or modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72836. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart