Description

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check (unlike the sibling raw, preview, and subtitle paths). As a result, an authenticated user provisioned with Perm.Download=false can obtain a content-hash oracle for any same-scope file (md5/sha1/sha256/sha512), enabling confirmation of known/guessed content, change detection, and offline brute-force of low-entropy files. This is an incomplete fix of CVE-2026-35606; it bypasses only the Download permission and does not defeat scope/path authorization.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-14T12:16:46.807Z",
  "pubdate": "2026-08-14T12:16:46.807Z",
  "executiveSummary": "A permission bypass vulnerability exists in filebrowser before version 2.63.19 within the /api/resources endpoint. This security flaw represents an incomplete fix of CVE-2026-35606. The vulnerability allows an authenticated user provisioned with restricted permissions where Perm.Download equals false to obtain a content-hash oracle for any file within the same scope. The affected system exposes checksum generation capabilities through the ?checksum= parameter without enforcing the necessary Perm.Download check, deviating from how sibling paths like raw, preview, and subtitle handle access control. The impact includes the ability to confirm known or guessed file contents, perform change detection, and execute offline brute-force attacks against low-entropy files. Exploitation requires authentication to the target system and valid scope access, while bypassing strictly the download authorization check without defeating scope or path authorization boundaries.",
  "technicalDetails": "The vulnerability resides in the resourceGetHandler function within the /api/resources endpoint of filebrowser. Specifically, the checksum branch, invoked via the ?checksum= query parameter, fails to validate whether the requesting user possesses the Perm.Download authorization. While sibling operational paths such as raw, preview, and subtitle properly enforce authorization checks before processing file data, the checksum code path directly reads the entire targeted file into memory to compute a cryptographic digest—supporting algorithms including md5, sha1, sha256, and sha512—and returns the resulting digest to the caller without restriction.\nThe root cause is an insufficient access control implementation during the handling of resource requests, acting as an incomplete fix for CVE-2026-35606. Although scope and path authorization logic remains intact and prevents arbitrary path traversal outside the user's designated scope, the lack of a proper permission verification on the hashing operation permits unauthorized derivation of file state information.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker with limited privileges, explicitly lacking download rights (Perm.Download=false), identifies a target file within their authorized scope. Second, the attacker issues an HTTP GET request to the /api/resources endpoint targeting the file path while appending the ?checksum= query parameter specifying the desired hashing algorithm. Third, the backend resourceGetHandler reads the requested file in its entirety, computes the cryptographic digest, and responds with the hash value. Fourth, the attacker leverages this returned hash as a content-hash oracle. By comparing the obtained digest against precomputed hashes of known files, targeted wordlists, or low-entropy structures, the attacker confirms file contents, detects unauthorized modifications, or conducts offline brute-force attacks to recover sensitive plaintext data without ever triggering a formal file download event."
}