CVE-2026-72834

MEDIUM 4.3

filebrowser before 2.63.19 Permission Bypass via checksum

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check (unlike the sibling raw, preview, and subtitle paths). As a result, an authenticated user provisioned with Perm.Download=false can obtain a content-hash oracle for any same-scope file (md5/sha1/sha256/sha512), enabling confirmation of known/guessed content, change detection, and offline brute-force of low-entropy files. This is an incomplete fix of CVE-2026-35606; it bypasses only the Download permission and does not defeat scope/path authorization.

CWE	CWE-200
Vendor	filebrowser
Product	filebrowser
Published	Aug 14, 2026

Stay Ahead of the Next One

Get instant alerts for filebrowser filebrowser

Be the first to know when new medium vulnerabilities affecting filebrowser filebrowser are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

filebrowser / filebrowser

0 < 2.63.19

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7whw-q6gh-xr59 github.com: https://github.com/filebrowser/filebrowser/commit/b7dc392838f11d188f0bc0f2a1a99fad3f7dca03 vulncheck.com: https://www.vulncheck.com/advisories/filebrowser-before-permission-bypass-via-checksum

Credits

🔍 arpitjain099 hacdias