vulnti.work

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser…

高危 CVSS 8.1
CVECVE-2026-72836
首次发现2026-08-14 12:30 UTC
披露时间2026-08-14 12:16 UTC
最后更新2026-08-14 12:30 UTC
通道状态auto

摘要

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the per…

中文摘要建设中,暂以英文摘要呈现(DR-003 v2)。

深度研判

该漏洞尚未生成深度研判报告(DR-003 v2 AI pipeline 建设中)。

数据来源

  • NVD DATABASE

原始链接

时间线

  1. nvd_ingest NVD