Technical impact
File Browser builds user scopes from usernames passed through a cleanUsername() routine when signup and directory creation are enabled. The normalization process collapses distinct usernames such as "team/one", "team one" and "team-one" to the same string, and the code fails to check whether the resulting scope is already in use. As a result, a second registrant can obtain full read and write access to another user's home directory. This elevation of privilege can lead to confidentiality and integrity violations of stored files and associated data.
Affected Systems
The vulnerability exists in File Browser versions prior to 2.63.17. All installations that allow user signup with automatic directory creation are affected. The fix is provided in release 2.63.17. Vendor is filebrowser and product is File Browser.
Risk and Exploitability
The CVSS score of 8.1 indicates high severity. The EPSS score of less than 1% suggests a very low probability of exploitation at the present time, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is the public signup interface; an attacker can register a colliding username remotely and thereby gain access to another user's files. Because the flaw resides in input‑validation logic leading to an authorization bypass, it is relatively easy to exploit if the application is exposed to attackers.
Github GHSA