Home directory collision via case-folded usernames in FileBrowser (CVE-2026-72836)

FileBrowser's self-registration handler compares stored directory scopes with a case-sensitive exact string match, while Windows/NTFS resolves paths case-insensitively. When Signup and CreateUserDir are both enabled and FileBrowser's root resides on a case-insensitive filesystem, two accounts whose usernames differ only in letter case (e.g., CaseVictim and casevictim) are accepted as distinct but receive the same physical home directory. An unauthenticated attacker who can reach the signup endpoint can therefore register a case-variant of an existing username and gain read, write, and delete access to that account's files through ordinary authenticated HTTP endpoints, without any victim interaction. Affected versions: - <= 2.63.18 We recommend updating to: 2.63.19. CVSS 9.2 · our assessment: act_now Reference: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-576v-w77m-gr84 Details: https://vuln.today/cve/CVE-2026-72836