CVE-2026-72834: filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check (unlike the sibling raw, preview, and subtitle paths). As a result, an authenticated user provisioned with Perm.Download=false can obtain a content-hash oracle for any same-scope file (md5/sha1/sha256/sha512), enabling confirmation of known/guessed content, change detection, and offline brute-force of low-entropy files. This is an incomplete fix of CVE-2026-35606; it bypasses only the Download permission and does not defeat scope/path authorization.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filebrowserto a version that resolves this vulnerability.Fixed in 2.63.19Patch CVE-2026-35606 - Compensating control
Restrict access to the FileBrowser /api/resources checksum (?checksum=) functionality (e.g., via network/WAF rules) until the fixed version is deployed, because the checksum branch can return digests without enforcing Perm.Download and does not defeat scope/path authorization.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72834?
CVE-2026-72834 has a medium severity rating of 4.3.
What is CVE-2026-72834?
CVE-2026-72834 is a permission bypass vulnerability in Filebrowser before version 2.63.19.
How do I fix CVE-2026-72834?
To fix CVE-2026-72834, upgrade Filebrowser to version 2.63.19 or later.
What type of vulnerability is CVE-2026-72834?
CVE-2026-72834 is classified as an info leak due to a permission bypass.
What impact does CVE-2026-72834 have on Filebrowser?
CVE-2026-72834 allows unauthorized users to access files through the /api/resources endpoint without proper permission checks.