CVE-2026-72834 filebrowser CVE debrief

Who should care

Defenders responsible for filebrowser deployments should assess exposure and prioritize patching or mitigation. This includes administrators and security teams managing filebrowser instances, especially those with authenticated users who may be impacted by the permission bypass.

Why it matters

CVE-2026-72834 is a permission bypass vulnerability in filebrowser that allows authenticated users with limited permissions to obtain a content-hash oracle for any file in the same scope. Defenders should prioritize verifying the version of filebrowser in use, assessing exposure, and applying the patch or mitigation as recommended by the vendor.

• Content confirmation: An attacker can verify the content of files without having download access
• Change detection: An attacker can detect changes to files without having download access
• Offline brute-force attacks: An attacker can attempt to brute-force low-entropy files offline using the content-hash oracle

Technical summary

The /api/resources endpoint in filebrowser before 2.63.19 allows an authenticated user with limited permissions (Perm.Download=false) to obtain a content-hash oracle for any file in the same scope. This enables content confirmation, change detection, and offline brute-force attacks on low-entropy files. The issue bypasses the Download permission but does not defeat scope/path authorization. An attacker can verify the content of files without having download access, detect changes to files without having download access, and attempt to brute-force low-entropy files offline using the content-hash oracle.

Defensive priority

Defenders should prioritize verifying the version of filebrowser in use, assessing exposure, and applying the patch or mitigation as recommended by the vendor.

Recommended defensive actions

• Verify the version of filebrowser in use and assess exposure
• Apply the patch or mitigation recommended by the vendor
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source-specific information. The issue is a permission bypass in the /api/resources endpoint of filebrowser before version 2.63.19, allowing authenticated users with limited permissions to obtain a content-hash oracle for any file in the same scope. This enables content confirmation, change detection, and offline brute-force attacks on low-entropy files. Defenders should verify the version of filebrowser in use,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.