FileBrowser versions prior to 2.63.19 fail to perform a case‑sensitive check of filesystem ownership when handling self‑registration. The flaw allows an attacker to create two accounts whose usernames differ only by letter case. Because the application stores the scope as a case‑sensitive string but resolves the home directory on a case‑insensitive filesystem, both accounts point to the same physical home directory. As a result, an attacker who registers a second account can read, overwrite, and delete files owned by the first account through authenticated endpoints, without the need for the victim’s credentials or further interaction.

The vulnerability affects the FileBrowser application (filebrowser:filebrowser) in all releases before 2.63.19. Any installation that enables both the Signup and CreateUserDir features and has its root directory located on a case‑insensitive filesystem, such as Windows/NTFS, is potentially impacted. The vendor list is limited to FileBrowser; no specific external products are known to be affected.

The flaw carries a CVSS score of 9.2, indicating critical severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the public self‑registration interface, where an attacker can supply a second username that only differs in case from an existing account. Exploitation requires no special privileges beyond creating a new account, making the attack straightforward for unauthenticated users. The impact spans confidentiality, integrity, and availability for the affected accounts’ file systems.