CVE-2026-62685
Summary
FileBrowser confines each user to a *scope*: a home directory that acts as the boundary for everything they can read or write. When self-registration and automatic home-directory creation are both enabled (Signup=true and CreateUserDir=true), a new user's scope is built from their username after it passes through cleanUsername(). That function rewrites the name: it strips .. and replaces every character outside 0-9A-Za-z@_\-. with -.
The problem is that this rewrite is many-to-one: different usernames can produce the same result, and FileBrowser never checks whether the resulting scope is already taken. So team/one, team one, and team-one all collapse to the same directory name, and whoever registers second is handed the same home directory as the first user instead of an isolated one.
This breaks per-user isolation. An attacker can pick a username that normalizes onto a victim's directory (for example registering alice/ or al..ice to land in alice's home) and gain full read and write access to that victim's files. Because username uniqueness is enforced on the raw name, both accounts coexist normally and neither user is warned that they share storage.
Details
1. The home directory is built straight from the cleaned username (settings/dir.go:30)
// MakeUserDir, when CreateUserDir is true:
username = cleanUsername(username)
// ...
userScope = path.Join(s.UserHomeBasePath, username) // line 30
userScope = path.Join("/", userScope) // line 33
The user's scope is path.Join(UserHomeBasePath, cleanUsername(username)).
2. cleanUsername collapses distinct inputs to the same output (settings/dir.go:42-52)
func cleanUsername(s string) string {
s = strings.Trim(s, " ")
s = strings.ReplaceAll(s, "..", "") // line 45, deletes ".."
s = invalidFilenameChars.ReplaceAllString(s, "-") // line 48, any non [0-9A-Za-z@_.-] -> "-"
s = dashes.ReplaceAllString(s, "-") // line 51, collapse repeated "-"
return s
}
Because several characters all map to - (and .. is simply de
⚡ Watch CVE-2026-62685
Get an email if CVE-2026-62685 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.32% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 25% of all EPSS-scored CVEs.
Advisory coverage (2)
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-62685)