{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/filebrowser--2.63.16/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-62685"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FileBrowser \u003c= 2.63.16"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","web-application","filebrowser","vulnerability"],"_cs_type":"advisory","_cs_vendors":["FileBrowser"],"content_html":"\u003cp\u003eFileBrowser, an open-source file manager, is affected by CVE-2026-62685, a high-severity authorization bypass vulnerability. This flaw, present in versions up to 2.63.16, allows an unauthenticated attacker to gain full read and write access to other users' files. The vulnerability stems from a collision in username normalization during the self-registration process when both \u003ccode\u003eSignup=true\u003c/code\u003e and \u003ccode\u003eCreateUserDir=true\u003c/code\u003e settings are enabled. The \u003ccode\u003ecleanUsername()\u003c/code\u003e function, responsible for sanitizing usernames before creating user home directories, can map different input usernames to the same directory name. Attackers can register a crafted username (e.g., \u003ccode\u003ealice/\u003c/code\u003e, \u003ccode\u003eal..ice\u003c/code\u003e) that normalizes to an existing victim's home directory (e.g., \u003ccode\u003ealice\u003c/code\u003e), effectively sharing the same storage. This bypasses FileBrowser's per-user isolation, enabling data exfiltration, tampering, or deletion. Defenders should understand this vulnerability as it directly impacts data confidentiality and integrity for organizations using affected FileBrowser instances.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn administrator configures a FileBrowser instance with \u003ccode\u003eSignup=true\u003c/code\u003e and \u003ccode\u003eCreateUserDir=true\u003c/code\u003e, allowing new users to self-register and automatically create their home directories.\u003c/li\u003e\n\u003cli\u003eA legitimate user registers an account (e.g., \u003ccode\u003eteamone-x\u003c/code\u003e), and FileBrowser creates a unique home directory for them (e.g., \u003ccode\u003e/srv/users/teamone-x\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eAn attacker registers a new account using a distinct username (e.g., \u003ccode\u003eteamone/x\u003c/code\u003e) that, after being processed by FileBrowser's \u003ccode\u003ecleanUsername()\u003c/code\u003e function, normalizes to the \u003cem\u003esame\u003c/em\u003e home directory path (\u003ccode\u003e/srv/users/teamone-x\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker logs in using their newly created colliding account.\u003c/li\u003e\n\u003cli\u003eThe legitimate victim user creates or uploads sensitive files into their home directory (e.g., \u003ccode\u003esecretA.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker, logged in with their colliding account, sends a request to read \u003ccode\u003esecretA.txt\u003c/code\u003e via the FileBrowser API and successfully retrieves the victim's confidential data.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a request to overwrite \u003ccode\u003esecretA.txt\u003c/code\u003e with malicious or tampered content via the FileBrowser API.\u003c/li\u003e\n\u003cli\u003eThe legitimate victim user subsequently accesses \u003ccode\u003esecretA.txt\u003c/code\u003e and observes the tampered content, unaware that their data has been compromised.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability leads to several critical impacts if exploited. An attacker registering a colliding username can achieve cross-user read access, allowing them to view every file within a victim's home directory. Furthermore, the attacker gains cross-user write and tamper capabilities, enabling them to overwrite, rename, or delete the victim's files, with the victim transparently seeing the tampered content. This directly bypasses the per-user isolation mechanism designed to confine each self-registered user to their designated scope. The attack can be targeted against known usernames or opportunistic. The precondition for exploitation is that the FileBrowser administrator must have both \u003ccode\u003eSignup\u003c/code\u003e and \u003ccode\u003eCreateUserDir\u003c/code\u003e settings enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch FileBrowser instances to a version greater than 2.63.16 to address CVE-2026-62685 immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the \u003ccode\u003eSignup\u003c/code\u003e and \u003ccode\u003eCreateUserDir\u003c/code\u003e settings in FileBrowser to mitigate the attack vector.\u003c/li\u003e\n\u003cli\u003eImplement checks to ensure the derived scope for user directories is canonical and unique, as suggested by the recommended fix for CVE-2026-62685.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T22:21:11Z","date_published":"2026-07-20T22:21:11Z","id":"https://feed.craftedsignal.io/briefs/2026-07-filebrowser-username-collision/","summary":"A critical authorization bypass vulnerability, CVE-2026-62685, in FileBrowser versions \u003c= 2.63.16 enables an attacker to gain full read and write access to other users' files by exploiting a username normalization collision during self-registration, thus bypassing per-user isolation and allowing data tampering or exfiltration.","title":"FileBrowser Username Normalization Collision Leads to Authorization Bypass","url":"https://feed.craftedsignal.io/briefs/2026-07-filebrowser-username-collision/"}],"language":"en","title":"CraftedSignal Threat Feed - FileBrowser \u003c= 2.63.16","version":"https://jsonfeed.org/version/1.1"}