File Browser CVE-2026-62685

Exploitation requires the instance to run with both the Signup feature enabled (Signup=true) and per-user home-directory creation enabled (CreateUserDir=true) - neither is a universal default, so this is a configuration-dependent flaw. The attacker must additionally supply a registration username that cleanUsername() normalizes to the same scope as an already-registered victim (for example registering 'team/one' or 'team one' to collide with 'team-one'), which presupposes knowledge or a good guess of an existing username's canonical form. What limits exploitation: the specific non-default two-setting configuration, the need to target an existing user's scope, and the CVSS AC:H reflecting the effort to produce a valid collision; no authentication is required because registration is open (PR:N).

The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H): network-reachable, unauthenticated, no user interaction, with high confidentiality, integrity, and availability impact on the victim's files, but High attack complexity. The AC:H rating is well justified - success depends on the attacker knowing or guessing a victim username that normalizes to the same scope and registering it, and the whole issue only exists under the non-default combination Signup=true plus CreateUserDir=true. No EPSS score was provided, the CVE is not in CISA KEV, and no proof-of-concept exploit was supplied - only the vendor fix commit and a regression test. There is no SSVC decision data in the input. Net assessment: a genuine and cleanly-confirmed authorization flaw, but real-world priority is bounded by the required non-default configuration and the complexity of engineering a colliding username; treat it as important for instances that expose open self-registration, and lower priority otherwise. Note the tag labels this 'Information Disclosure', which understates it - the CVSS I:H/A:H and the description both indicate full write access, not just disclosure.

On a File Browser instance with open signup and per-user directories enabled, an attacker learns or guesses a target's username (e.g., a display name containing a space or slash) and registers a distinct variant that cleanUsername() normalizes to the same scope. The server hands the attacker the victim's existing home directory, granting full read, modification, and deletion of the victim's files. No public exploit code was provided, and the High attack complexity reflects the need to craft a colliding username.