CVE-2026-62685 Details
Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and CreateUserDir=true, but the many-to-one normalization can collapse usernames such as team/one, team one, and team-one to the same home directory without checking whether the resulting scope is already taken, allowing a second registrant to gain full read and write access to another user's files. This issue is fixed in version 2.63.17.
A vulnerability in File Browser prior to version 2.63.17 allows for cross-user file access due to a username normalization issue. When self-registration and automatic home directory creation are enabled, usernames are cleaned and normalized in a way that different inputs can result in the same output. This many-to-one normalization can cause two users to share the same home directory, breaking the intended isolation. An attacker can exploit this by registering a username that collides with an existing user, gaining full read and write access to that user's files.
Users can update to File Browser version 2.63.17, which addresses this vulnerability by rejecting signups that would result in colliding home directories.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7rc3-g7h6-22m7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/filebrowser/filebrowser/commit/883a36f02fcb69566a8628cb47f18fdc73348387 | [email protected] | Source CodeVendor |
| https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17 | [email protected] | Release NotesVendor |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7rc3-g7h6-22m7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | [email protected] |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| File Browser | <= 2.63.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |