Which versions of FileBrowser are affected by CVE-2026-72836?

FileBrowser servers on Windows and similar case-insensitive filesystems are vulnerable to unauthorized cross-user file access and deletion through account takeover, exposing shared files to data…. A patch is available.

How to fix or mitigate CVE-2026-72836?

Within 24 hours, identify all FileBrowser instances in your environment and verify their current version; if running versions before 2.63.19, apply the vendor-released patch immediately or disable public self-registration as an interim measure. Within 7 days, confirm patch deployment across all affected FileBrowser instances and validate that self-registration access controls are properly configured to restrict registration to authenticated users only, or disable if unnecessary. Within 30 days, conduct a forensic audit of FileBrowser file-access logs to detect any unauthorized cross-user file access, and notify affected users of potential exposure if evidence of exploitation is identified.

FileBrowser CVE-2026-72836

Q: What is the CVSS score of CVE-2026-72836?

CVE-2026-72836 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-58650 CRITICAL

Improper Handling of Case Sensitivity (CWE-178)

2026-08-14 VulnCheck

GHSA-f37p-wpgx-m9mr

Information Disclosure Microsoft Filebrowser

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

No account needed via self-signup (PR:N), but requires a case-insensitive FS plus enabled signup/CreateUserDir and a username-collision race (AC:H); full read/write/delete of victim files gives C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 14, 2026 - 12:24 vuln.today

Analysis Generated

Aug 14, 2026 - 12:24 vuln.today

CVE Published

Aug 14, 2026 - 11:35 cve.org

CRITICAL 9.2

DescriptionCVE.org

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.

AnalysisAI

Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Discover FileBrowser instance with open signup on NTFS

Exploit

Self-register username differing only in case from victim

Execution

Authenticate to new account resolving to victim's directory

Impact

Read, overwrite, or delete victim files via HTTP endpoints

Access

Discover FileBrowser instance with open signup on NTFS

Exploit

Self-register username differing only in case from victim

Execution

Authenticate to new account resolving to victim's directory

Impact

Read, overwrite, or delete victim files via HTTP endpoints

Vulnerability AssessmentAI

Exploitation	Exploitation requires the FileBrowser instance to have both Signup (self-registration) and CreateUserDir enabled, and its root directory to reside on a case-insensitive filesystem (confirmed Windows/NTFS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine, actionable authorization flaw rather than an inflated high-CVSS score, but its real-world reach is gated by configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker browses to a public Windows-hosted FileBrowser instance that allows self-registration, notes an existing username, and registers a variant differing only in letter case (e.g. registering 'casevictim' to target 'CaseVictim'). …
Remediation	Upgrade to FileBrowser 2.63.19 or later, which contains the vendor fix delivered in commit fe7efb2e6afe66774cd86a5b0a03033bd514d0c0 (see advisory GHSA-576v-w77m-gr84). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all FileBrowser instances in your environment and verify their current version; if running versions before 2.63.19, apply the vendor-released patch immediately or disable public self-registration as an interim measure. …

Threat intelligence, references, and detailed analysis are available after sign-in.