This vulnerability exploits a fundamental mismatch between how Go handles string comparison and how operating systems handle filesystem paths. The core issue: FileBrowser compares scope identifiers (usernames, directory names) using case-sensitive string matching, but creates directories via os.MkdirAll, which performs case-insensitive path resolution on Windows NTFS and macOS HFS+. These two behaviors are independent and individually correct—they only conflict when the code runs on a case-insensitive filesystem.
Specifically, when both Signup and CreateUserDir are enabled, registering with a username like "Admin" grants access to directories created under "admin" (or "ADMIN"), because the ownership check sees a different string while the filesystem sees the same directory. This is not a naive string comparison error; it's a cross-platform assumption embedded in code developed on case-sensitive Linux systems that silently fails on the platforms where it matters most.
What makes this particularly dangerous is that it cannot be detected during normal development. There is no linter warning, no test assertion, and no compiler flag that catches case-sensitive security logic on a case-sensitive development machine. The vulnerability exists dormant in the code regardless of the deployment platform—it simply doesn't trigger on Linux. This means the fix must be proactive, not reactive.
The correct remediation is case-normalizing all scope comparisons to a canonical form (lowercase) before any ownership check. This eliminates the entire class of cross-platform path-confusion vulnerabilities permanently, rather than patching the registration endpoint while leaving similar assumptions in file move, rename, or sharing operations. Verify that the patch applies normalization globally across all security-critical path comparisons, not just the registration flow where this vulnerability was discovered.