Administrator account creation via unvalidated cross-origin request

Cross-site request forgery in File Browser before 2.18.0 allows remote attackers to create an administrator account through a malicious webpage. The /api/users endpoint accepts text/plain form submissions without validating the Origin header or requiring an anti-CSRF token, then creates a user from the supplied fields. Exploitation requires an authenticated administrator to visit the page; the forged account can access an attacker-chosen filesystem scope and run permitted commands when command execution is enabled.