The vulnerability in filebrowser before version 2.63.19 involves the /api/resources endpoint's checksum (?checksum=) functionality. Unlike other resource access paths, this branch reads the entire file to compute a digest (md5/sha1/sha256/sha512) and returns it without checking the Perm.Download permission. Consequently, an authenticated user with Perm.Download=false can retrieve content hashes for files within their authorized scope. This enables the user to confirm known or guessed file contents, detect file changes, and perform offline brute-force attacks on low-entropy files. The vulnerability is an incomplete fix of CVE-2026-35606, as it only bypasses the download permission but respects scope and path authorization.

An attacker with authenticated access but without download permissions can obtain cryptographic hashes of files within their authorized scope. This leakage of content hashes can be used to confirm guessed file contents, detect unauthorized changes, or brute-force low-entropy files offline. The vulnerability does not allow direct file download or access outside the authorized scope, limiting its impact to information disclosure of file content hashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions carefully and monitor for suspicious activity. Since this is an incomplete fix of a previous vulnerability, ensure that all related patches and updates are applied once released.