With per-user home folders turned on, an account whose name cleans to nothing or to another user's name gets the wrong home: every user's files, or one victim's. It can read, create and overwrite them.

What happens

With createUserDir on, FileBrowser Quantum gives each new account a home folder built from its username, after a cleanup step deletes every .. from the name. The result is never checked.

• An account named .. cleans to an empty name, so it keeps the source’s default scope: the folder that holds every user’s home.
• An account named b..ob or ..bob cleans to bob, so it is given bob’s home.
• With a default scope of /users, an account named users keeps /users itself.

The new account then lists, reads, creates and overwrites the other users’ files through the normal API. Every way of creating an account shares this code: first sign-in through OIDC, a proxy header, JWT or LDAP, password self-signup, and creation by an admin.

Who is exposed

Deployments with createUserDir: true where new users choose their own username: an identity provider that lets users pick the asserted name, or password self-signup. The project’s own OIDC, JWT and proxy example configurations turn createUserDir on. With self-signup enabled, no account is needed at all.

Fix

Upgrade to 2.0.1-stable or 2.1.2-beta. Admins should also review existing accounts whose names contain .. or /, or match the last part of a default user scope: an account created before the fix keeps the scope it was given.

How it was proved and reported

Proved end to end on our own copies of the official 2.0.0-stable and 2.1.1-beta images, through a local identity provider and through self-signup, with a control user on every run. Reported privately to the maintainer with a patch and tests, and published by the maintainer on 13 October 2026.