CVE-2026-62685: FileBrowser Username Normalization Vulnerability Leading to Home Directory Collision
Summary
CVE-2026-62685: File Browser: Colliding username normalization gives two users the same home directory. Affects github.com/filebrowser/filebrowser/v2 versions < 2.63.17. Fixed in 2.63.17. How to fix ↓
Also tracked for
The same CVE-2026-62685 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FileBrowser is an open-source file management tool that allows users to manage files on a server through a web interface. It provides functionalities such as file uploads, downloads, and user management. Each user is confined to a specific home directory, which is intended to isolate their files from other users. However, a vulnerability exists in the way usernames are normalized, potentially allowing multiple users to share the same home directory, thus compromising user data security.
Vulnerability Detail
The vulnerability arises from the cleanUsername() function, which normalizes usernames by stripping certain characters and replacing others with a hyphen. This process can lead to different usernames collapsing into the same normalized value, allowing an attacker to register a username that shares a home directory with a victim. As a result, the attacker can read, overwrite, or tamper with the victim's files, violating the intended per-user isolation. The lack of a uniqueness check for the normalized directory name exacerbates this issue, making it possible for multiple users to coexist in the same directory without any warning.
How To Fix
Latest published version: v2.63.23 as of 22 Oct 2026
go get github.com/filebrowser/filebrowser/v2@v2.63.23Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.63.17
This is the first release that contains the fix.
go get github.com/filebrowser/filebrowser/v2@v2.63.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the self-registration feature by setting Signup=false in the configuration. This will prevent new users from registering and potentially colliding with existing usernames until the package is updated.
Conclusion
The FileBrowser vulnerability CVE-2026-62685 poses a significant risk by allowing multiple users to share the same home directory due to username normalization issues. It is crucial to update to the patched version 2.63.17 or later to mitigate this risk and ensure user data isolation.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
An attacker can gain unauthorized access to another user's files by registering a colliding username, leading to potential data breaches.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Ensure that both Signup and CreateUserDir settings are carefully managed, and consider disabling self-registration until the vulnerability is patched.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
Yes, you can manually check for potential username collisions by reviewing the normalized output of the cleanUsername() function for existing usernames.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
