CVE-2026-72834
Received Received - Intake

Permission Bypass in FileBrowser via Content-Hash Oracle

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check (unlike the sibling raw, preview, and subtitle paths). As a result, an authenticated user provisioned with Perm.Download=false can obtain a content-hash oracle for any same-scope file (md5/sha1/sha256/sha512), enabling confirmation of known/guessed content, change detection, and offline brute-force of low-entropy files. This is an incomplete fix of CVE-2026-35606; it bypasses only the Download permission and does not defeat scope/path authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72834
EUVD
EUVD-2026-58648

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser to 2.63.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72834 is a permission bypass in filebrowser versions before 2.63.19. It allows authenticated users with Perm.Download=false to compute file content hashes (MD5, SHA1, SHA256, SHA512) via the /api/resources endpoint without proper authorization checks. This creates a content-hash oracle enabling attackers to confirm guessed file content, detect changes, or brute-force low-entropy files offline.

Detection Guidance

To detect this vulnerability, check if your filebrowser version is before 2.63.19. Use commands like 'filebrowser version' or inspect the running process to identify the version. Then verify if the /api/resources endpoint with checksum parameter is accessible to users with Perm.Download=false.

Impact Analysis

An attacker could exploit this to confirm known or guessed file content, detect changes over time, or perform offline brute-force attacks on low-entropy files. This could lead to unauthorized data exposure or compromise of sensitive information if files contain predictable content.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to sensitive data through content-hash oracles. GDPR and HIPAA mandate strict access controls and data protection; such bypasses undermine these controls, potentially leading to data breaches and non-compliance penalties.

Mitigation Strategies

Upgrade filebrowser to version 2.63.19 or later immediately. This version includes the necessary patch to enforce Perm.Download checks in the checksum branch of the /api/resources endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72834. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart