FileBrowser EUVD-2026-58650

Exploitation requires the FileBrowser instance to have both Signup (self-registration) and CreateUserDir enabled, and its root directory to reside on a case-insensitive filesystem (confirmed Windows/NTFS). Given those, no existing account and no victim interaction are needed: the attacker self-registers a username that differs from the target's only in letter case, which is stored as a distinct account but maps to the same home directory. Limiting factors: on case-sensitive Linux filesystems the collision does not occur; if self-signup or per-user directory creation is disabled the attack path is closed; and the attacker generally must know or guess a target username and register the specific cased variant, which is why CVSS marks AC:H/AT:P.

This is a genuine, actionable authorization flaw rather than an inflated high-CVSS score, but its real-world reach is gated by configuration. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) reflects unauthenticated network reachability with full confidentiality/integrity/availability impact on victim files, tempered by AC:H and AT:P - exploitation requires a case-insensitive root filesystem plus enabled self-signup and CreateUserDir, and typically that the attacker registers the colliding username. There is no CISA KEV entry and no public exploit identified at time of analysis, and no EPSS value was supplied, so there is no signal of active or automated exploitation; the risk is 'reliable when preconditions are met' rather than 'mass-exploited.' Given that the confirmed-vulnerable deployment mode is Windows/NTFS hosting with open registration, exposure skews toward internet-facing or multi-tenant instances, and any operator running such a configuration should treat patching as urgent because the attack needs no victim interaction and no pre-existing account.

An attacker browses to a public Windows-hosted FileBrowser instance that allows self-registration, notes an existing username, and registers a variant differing only in letter case (e.g. registering 'casevictim' to target 'CaseVictim'). Their new account's home scope resolves to the victim's physical directory, so via normal authenticated file endpoints they read, overwrite, or delete the victim's files. No public exploit code has been identified at time of analysis, but the technique requires no special tooling.