FileBrowser before version 2.63.19 does not properly handle case-insensitive filesystems during home directory ownership checks in self-registration. Specifically, when Signup and CreateUserDir features are enabled and the root directory is on a case-insensitive filesystem (e.g., Windows/NTFS), two usernames differing only by case (e.g., CaseVictim and casevictim) are treated as distinct accounts but resolve to the same physical directory. The ownership check compares the scope as a case-sensitive string, failing to detect this overlap. Consequently, an attacker can register a username differing only in case from a victim's username and gain unauthorized read, write, and delete access to the victim's files via authenticated HTTP endpoints, without needing an existing account or victim interaction.

An attacker can exploit this vulnerability to access, modify, or delete files belonging to another user by registering a username that differs only in case on a case-insensitive filesystem. This results in complete compromise of the victim's home directory data through the FileBrowser interface, impacting confidentiality, integrity, and availability of user files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid enabling Signup and CreateUserDir features on case-insensitive filesystems or restrict self-registration. Monitor vendor channels for updates addressing this issue.