CVE-2026-72836

COMPONENT VERSION RANGE

NewScan fingerprints FileBrowser from its response and reports this CVE when the detected version falls inside the affected range below.

MEASURED 2026-08-14 against filebrowser/filebrowser v2.63.18 (affected) and v2.63.19 (patched) on loopback. The version is captured IN-BAND by the tech_signatures "FileBrowser" row out of the window.FileBrowser bootstrap object on /, so this row costs no request of its own. The bug: the home directory ownership check during self-registration does not fold case, so on a case-insensitive filesystem (every default Windows and macOS install, and any SMB/NTFS-backed volume under Linux) registering `Admin` resolves to the existing `admin` user's directory and hands the attacker their files. VERSION-MATCH ONLY, and the precondition is why: the bug needs BOTH Signup and CreateUserDir enabled, and the same anonymous window.FileBrowser object publishes "Signup":false on a stock install - so the honest gate would be version AND Signup, which a known_vulns row cannot express (it compares versions, nothing else). Confirming it in-band would mean actually registering an account on a stranger's file server and taking a directory over, which reproduce-before-record does not license. Reading Signup as a second condition is the natural follow-up and is filed in docs/backlog.md rather than half-done here; until then this row is deliberately BROAD - true of the version, not proven of the instance - and its note carries the precondition so an assessor is not told a login-only install is exploitable.