# CVE-2026-62685: File Browser directory traversal and isolation bypass via username normalization collision

Source: https://junglewise.ai/threats/cve-2026-62685-file-browser-directory-traversal-and-isolation-bypass-via  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-62685 · Severity: high · CVSS 8.1 · Published 2026-07-15

File Browser, a web-based file management utility, contains a flaw in how it assigns storage folders to new users. When self-registration is enabled, the system simplifies usernames to create folder names (for example, turning 'user/one' and 'user-one' into the same folder). This allows a malicious actor to register a specific username that grants them full access to another user's private files, leading to data theft or unauthorized file modification.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser), [github.com/filebrowser/filebrowser (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser), [github.com/filebrowser/filebrowser/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-62685 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62685 being exploited in the wild.

**How severe is CVE-2026-62685?** High severity, with a CVSS score of 8.1, published 15 July 2026.

**Which products and versions are affected?** File Browser < 2.63.17, <= 2.63.16; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.16, SEMVER:introduced=0,fixed=2.63.17.

**Is there a fix for CVE-2026-62685?** Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62685 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-62685?** Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.17 or later

  ```sh
  go get github.com/filebrowser/filebrowser/v2@v2.63.17
  ```


## Technical details

The vulnerability exists in the `cleanUsername()` function within `settings/dir.go`, which performs a many-to-one normalization of usernames by stripping '..' and replacing non-alphanumeric characters with dashes. When `Signup` and `CreateUserDir` are enabled, File Browser fails to verify if the resulting normalized 'scope' (home directory) is already assigned to an existing user. An attacker can register a username that normalizes to a victim's existing scope (e.g., 'alice/' colliding with 'alice'), gaining full read/write access to the victim's files. The issue is addressed in version 2.63.17.

## Affected products

- File Browser filebrowser/filebrowser/v2 <= 2.63.16

## Identifiers

- CVE-2026-62685
- GHSA-7rc3-g7h6-22m7
- GO-2026-6024

## Timeline

- 2026-07-04: advisory: Initial GitHub Advisory published
- 2026-07-20: disclosed: Full advisory disclosure and timeline update

## References

- [https://api.github.com/users/je-lv](https://api.github.com/users/je-lv)
- [https://github.com/je-lv](https://github.com/je-lv)
- [https://api.github.com/users/je-lv/gists%7B/gist_id%7D](https://api.github.com/users/je-lv/gists%7B/gist_id%7D)
- [https://api.github.com/users/je-lv/repos](https://api.github.com/users/je-lv/repos)
- [https://avatars.githubusercontent.com/u/40743233?v=4](https://avatars.githubusercontent.com/u/40743233?v=4)
- [https://api.github.com/users/je-lv/events%7B/privacy%7D](https://api.github.com/users/je-lv/events%7B/privacy%7D)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)