External risk intelligence

FileBrowser Case-Insensitive Filesystem Directory Traversal.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-72836

FileBrowser is typically deployed as a self-hosted, internet-facing web application for remote file management and access. Since the vulnerability involves public-facing features like user self-registration, it is commonly accessible to users over the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a security issue in FileBrowser, a web-based file management tool, that could allow unauthorized access and modification of user files. The vulnerability is triggered when the software runs on systems with case-insensitive file systems, such as Windows, and specific user registration features are enabled. It means that individuals could potentially read, overwrite, or delete another user's files without proper authentication. The primary concern is to confirm if your deployed instances are affected by this specific configuration.

Accounts can be compromised by exploiting file system case differences.
Critical for preventing unauthorized file access and manipulation.
Assess impact and confirm relevance for your FileBrowser instances.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by registering two accounts with usernames that differ only in capitalization on a case-insensitive filesystem. Since the system incorrectly treats these as separate accounts but links them to the same physical directory, the second registered user can access and modify the files of the first user through the application's authenticated file management features.

Requires self-registration and case-insensitive filesystem.
Triggered by creating accounts with similar names.
Risk: Unauthorized file access and modification.

Live Threat

Current exploitation, exposure, and threat context

When FileBrowser is deployed on a case-insensitive filesystem with self-registration enabled, attackers could gain unauthorized access to other users' files. This occurs because the system treats usernames differing only in case as separate accounts but maps them to the same physical directory.

User files on case-insensitive systems.
Unauthenticated HTTP access to shared directories.
Unauthorized reading, overwriting, or deletion.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in FileBrowser, affecting self-registration on case-insensitive filesystems, is likely the responsibility of the application owner or platform team managing the FileBrowser instances. The first practical step is to identify all deployments, determine their exposure and criticality, and locate the accountable owner for each. Subsequent remediation planning should prioritize high-risk instances.

Application owners should manage the issue.
Verify exposed instances and their configurations.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FileBrowser?

FileBrowser is a lightweight, web-based file management application often used to provide remote access to file systems. It allows users to manage, upload, and organize files directly through a web browser. It is frequently deployed as a self-hosted service, enabling convenient access to local storage directories from any network location.

What does CWE-178 mean for CVE-2026-72836?

CWE-178 refers to Improper Handling of Case Sensitivity. In this CVE, FileBrowser fails to account for how operating systems like Windows interpret file paths. Because the software treats 'User' and 'user' as distinct usernames but the underlying filesystem maps them to the same directory, it creates a confusion where different account identities share access to the same physical storage space.

How is this FileBrowser vulnerability triggered?

An attacker triggers this by exploiting the self-registration feature when the application runs on a case-insensitive filesystem. By creating an account with a name that matches an existing user's name except for letter capitalization, the attacker can effectively 'collide' with the victim's account directory. This does not happen if the application is configured with self-registration disabled or if it is running on a filesystem that distinguishes between upper and lower case letters.

Is my FileBrowser instance at risk?

According to Halo Surface Signal, risk is likely if your FileBrowser instance is internet-facing and has self-registration features enabled. If your installation is restricted to a private network or requires manual account creation by an administrator, the attack surface is significantly reduced. You should prioritize checking any deployments that allow public or untrusted users to create their own accounts.

What should I do if I run FileBrowser?

First, identify all FileBrowser deployments in your environment and check if self-registration and CreateUserDir are enabled. Verify the underlying filesystem type to see if it is case-insensitive, such as NTFS on Windows. If these conditions are met, consider disabling self-registration or restricting access until you can update to version 2.63.19 or later to ensure proper directory ownership checks.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.