CyberRota Analysis
AI-GeneratedFileBrowser versions prior to 2.63.19 are vulnerable on Windows systems due to improper handling of case-insensitive filesystems, allowing multiple self-registered accounts that differ only in case to share the same home directory. This flaw enables an attacker to access, modify, or delete files belonging to another user without needing prior access or interaction. Organizations using FileBrowser with Signup and CreateUserDir enabled should prioritize patching this vulnerability to protect user data from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.