Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-72834filebrowser before 2.63.19 Permission Bypass via checksum

Medium 4.3

In plain English

A medium-severity information exposure in filebrowser from filebrowser. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check (unlike the sibling raw, preview, and subtitle paths). As a result, an authenticated user provisioned with Perm.Download=false can obtain a content-hash oracle for any same-scope file (md5/sha1/sha256/sha512), enabling confirmation of known/guessed content, change detection, and offline brute-force of low-entropy files. This is an incomplete fix of CVE-2026-35606; it bypasses only the Download permission and does not defeat scope/path authorization.

Affected products (as reported)

Vendor	Product	Versions
filebrowser	filebrowser	0 – before 2.63.19

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-7whw-q6gh-xr59) vendor-advisory
Patch Commit patch
VulnCheck Advisory: filebrowser before 2.63.19 Permission Bypass via checksum third-party-advisory