AFAICS, it's not only affecting resumes, but any upload to a special remote with chunking enabled.
This is a low-severity security hole.