Improper Handling of Case Sensitivity in FileBrowser - CVE-2026-72836
Published: July 27, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU139757
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72836
CWE-ID: CWE-178
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read, overwrite, and delete another user's files.
The vulnerability exists due to improper handling of case sensitivity in the signup username and home directory scope ownership check when creating self-registered accounts on a case-insensitive filesystem. A remote attacker can register a second account whose username differs only by letter case to read, overwrite, and delete another user's files.
Exploitation requires signup and automatic user directory creation to be enabled, with the application root located on a case-insensitive Windows filesystem.
Affected software
FileBrowser
How to mitigate CVE-2026-72836
Install security update from vendor's website.
FileBrowser - update to 2.63.19