EUVD-2026-44708
GHSA-7rc3-g7h6-22m7
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Open network signup gives PR:N/UI:N; crafting a username that normalizes to a victim's scope plus the non-default config warrants AC:H; the victim's files become fully readable and writable, so C/I/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directory without checking whether the resulting scope is already taken, allowing a second registrant to gain full read and write access to another user's files. This issue is fixed in version 2.63.17.
AnalysisAI
Home-directory hijacking in File Browser before 2.63.17 lets an unauthenticated attacker gain full read/write access to another user's files by registering a username that normalizes to a victim's scope. Because cleanUsername() is a many-to-one transform, distinct usernames such as team/one, team one, and team-one collapse to the same home directory, and the signup path never checked whether the derived scope was already owned. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix commit and a regression test are public, making the root cause well understood.
Technical ContextAI
File Browser (cpe:2.3:a:filebrowser:filebrowser) is a self-hosted Go web application providing a browser-based interface to upload, delete, preview, rename, and edit files under a per-user scope directory. When Signup=true and CreateUserDir=true, the signup handler derives each new user's home-directory scope from the submitted username after passing it through cleanUsername(), which strips/replaces characters (spaces, slashes, dashes) in a lossy, many-to-one fashion. This maps to CWE-647 (Use of Non-Canonical Value for Authorization Decisions): the non-canonical username is used to compute the authorization boundary (the scope) without verifying that the canonicalized result is unique. The patch introduces a GetByScope() lookup across the storage backends (bolt/users.go, users/storage.go, auth) and, in http/auth.go's signupHandler, rejects a signup with HTTP 409 Conflict when CreateUserDir is enabled and the derived scope already belongs to an existing user.
RemediationAI
Vendor-released patch: upgrade to File Browser v2.63.17, which adds a GetByScope() check in the signup handler that returns HTTP 409 Conflict when a newly derived home-directory scope is already owned (fix commit 883a36f02fcb69566a8628cb47f18fdc73348387; advisory GHSA-7rc3-g7h6-22m7). If you cannot upgrade immediately, the most effective compensating control is to disable open self-registration by setting Signup=false, which fully removes the attack surface at the cost of requiring administrators to provision accounts manually. Alternatively, disable per-username home-directory creation (CreateUserDir=false) so all signups share the configured default scope and no username-to-scope collision is possible, though this changes the isolation model and is only appropriate where per-user directories are not required; you may also front the signup endpoint with an approval workflow or network access controls. Confirm the fix and download from https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Filebrowser versions prior to 2.57.1 allow authenticated users to reset passwords without verifying the current password
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta all
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today