CVE-2026-72834: 
Wolfi vulnerability analysis and mitigation

CVE-2026-72834 is a permission bypass vulnerability in filebrowser (the open-source web-based file manager) affecting all versions before 2.63.19. The flaw resides in the /api/resources endpoint, where the ?checksum= branch of resourceGetHandler reads an entire file to compute a cryptographic digest and returns it without enforcing the Perm.Download permission check — unlike the sibling raw, preview, and subtitle paths. It is classified as an incomplete fix of CVE-2026-35606 and was disclosed on August 14, 2026. The CVSS v3.1 base score is 4.3 (Medium) and the CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is an incorrect authorization check (CWE-863 / CWE-200): the resourceGetHandler function in http/resource.go (lines ~69–79) handles the ?checksum= query parameter by calling file.Checksum(), which reads the full file into a hash function and returns the digest in the JSON response, but never checks d.user.Perm.Download. The three sibling read paths (raw.go:85, preview.go:39, subtitle.go:18) each guard this permission with if !d.user.Perm.Download { return http.StatusAccepted, nil }, making the omission in the checksum branch an inconsistency introduced when CVE-2026-35606 was partially patched in PR #5891 (v2.63.1). An attacker needs only a valid authenticated session token (X-Auth) and Perm.Download=false provisioning — no elevated privileges or special configuration beyond a standard low-privilege account are required. The vulnerability applies to any file type and any size within the user's authorized scope, with no text-only or size restrictions (GitHub Advisory).

A successfully exploited vulnerability allows an authenticated user whose Perm.Download flag is explicitly set to false to obtain MD5, SHA1, SHA256, or SHA512 hashes of any file within their authorized scope. This creates a content-hash oracle that enables an attacker to confirm known or guessed file contents, detect file changes over time, and conduct offline brute-force attacks against low-entropy files (e.g., configuration files with predictable values, short secrets, or password files). There is no integrity or availability impact, and the bypass does not circumvent scope or path authorization, limiting exposure to files the user is already permitted to browse (GitHub Advisory, Github Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date (Github Advisory). The EPSS score is approximately 0.228% (14th percentile), indicating a low near-term exploitation probability. CISA's SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable with partial technical impact. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Authenticate: Obtain a valid filebrowser session token (X-Auth) for an account provisioned with Perm.Download=false. This could be a legitimately provisioned low-privilege account or a compromised credential.
2. Identify target files: Browse the filebrowser interface or enumerate the /api/resources endpoint to identify files of interest within the user's authorized scope (e.g., configuration files, credential stores, or other low-entropy files).
3. Request checksum: Send an authenticated HTTP GET request to the /api/resources/<path/to/file>?checksum=sha256 endpoint (substituting sha256 with md5, sha1, or sha512 as desired), including the X-Auth header with the session token.
4. Receive hash: The server reads the full file, computes the requested digest, and returns it in the JSON response — bypassing the Perm.Download check — providing the attacker with the file's cryptographic hash.
5. Exploit the oracle: Compare the returned hash against known or guessed content to confirm file contents, monitor for changes by repeating requests over time, or perform offline brute-force attacks against low-entropy files using the hash as a verification oracle (GitHub Advisory).

• Network: Repeated or scripted HTTP GET requests to /api/resources/<path>?checksum=<algorithm> (where algorithm is md5, sha1, sha256, or sha512) from authenticated sessions belonging to users with Perm.Download=false.
• Logs: Filebrowser access logs showing GET /api/resources/...?checksum= requests returning HTTP 200 responses for accounts that should not be downloading files; high frequency of checksum requests against the same file path (indicating change-detection polling or brute-force oracle use).
• Behavioral: A low-privilege user account generating checksum API calls against sensitive files (e.g., configuration files, .env files, credential stores) without corresponding browse or upload activity.

Upgrade filebrowser to version 2.63.19 or later, which adds the missing Perm.Download check to the ?checksum= branch of resourceGetHandler, consistent with the raw, preview, and subtitle sibling paths (GitHub Advisory). No official configuration-based workaround has been published; as an interim measure, administrators can review and audit access logs for suspicious checksum requests against sensitive files, and consider restricting network access to the filebrowser instance to trusted users only. Organizations should also review user permission assignments to ensure Perm.Download=false is not relied upon as a sole confidentiality control until the patch is applied.