CyberRota Analysis
AI-GeneratedFile Browser versions prior to 2.63.17 are vulnerable to a directory traversal issue that allows multiple users to inadvertently share the same home directory due to improper normalization of usernames. This flaw can lead to unauthorized access, enabling one user to read and write files belonging to another user. Organizations using affected versions should prioritize upgrading to the fixed version to mitigate the risk of data breaches and unauthorized file access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directory without checking whether the resulting scope is already taken, allowing a second registrant to gain full read and write access to another user's files. This issue is fixed in version 2.63.17.