FileBrowser up to 2.63.18 Self-Registration information disclosure

Summaryinfo

A vulnerability was found in FileBrowser up to 2.63.18. It has been declared as problematic. Affected is an unknown function of the component Self-Registration. Executing a manipulation can lead to information disclosure. The identification of this vulnerability is CVE-2026-72836. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in FileBrowser up to 2.63.18. It has been declared as problematic. This vulnerability affects some unknown processing of the component Self-Registration. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-72836 since 08/10/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 2.63.19 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-58650). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• FileBrowser

Version

• 2.63.0
• 2.63.1
• 2.63.2
• 2.63.3
• 2.63.4
• 2.63.5
• 2.63.6
• 2.63.7
• 2.63.8
• 2.63.9
• 2.63.10
• 2.63.11
• 2.63.12
• 2.63.13
• 2.63.14
• 2.63.15
• 2.63.16
• 2.63.17
• 2.63.18

Website

• Product: https://github.com/filebrowser/filebrowser/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion