>Am I missing something, or would this let any node (supernode/browser) in the system potentially replace arbitrary content with their own content?
collision attack != preimage attack (what you're thinking of).
collision attack != preimage attack (what you're thinking of).
It does seem to me though that if I could coerce/direct the site into accepting one image that I created, I could manage to replicate a second, different file throughout the network. Obviously assuming I computed both images ahead of time and both image formats were unperturbed by the nonsense appended to file by the attack.
I get an edgemesh site to accept file A (perhaps the site allows me to upload a user avatar, upload an image on a forum, etc). I then behave as a node in the mesh, and receive file A. When I get a request to replicate file A to someone else, I send them file A', they check the MD5 hash, and the hash matches. Not seeing how that doesn't work?
It is admittedly a narrow attack, but I think it works.