PT-2026-60213 · Unknown · Filebrowser

CVE-2026-62685 · Published 2026-07-15 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.17

Description When Signup and CreateUserDir are both set to true, the software uses the cleanUsername() function to build new user scopes. A many-to-one normalization flaw allows different usernames (for example, team/one, team one, and team-one) to be mapped to the same home directory. Because the system fails to verify if the resulting scope is already occupied, a new registrant can obtain full read and write access to the files of another user.

Recommendations Update to version 2.63.17.

Exploit

Fix

Weakness Enumeration

CWE-706

CWE-647

Related Identifiers

CVE-2026-62685

GHSA-7RC3-G7H6-22M7

GO-2026-6024

OPENSUSE-SU-2026:21483-1

Affected Products

Filebrowser

References · 1745

• 🔥 https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7rc3-g7h6-22m7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62685.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-62685 · Security Note
• https://osv.dev/vulnerability/GHSA-7rc3-g7h6-22m7 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-6024 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-62685 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/commit/883a36f02fcb69566a8628cb47f18fdc73348387 · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17 · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note