CVE-2026-72838 in FileBrowser
Summary
by MITRE • 08/14/2026
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in FileBrowser versions prior to 2.63.19 represents a critical security flaw within the TUS (Transfer Uninterrupted) resumable upload implementation that directly impacts the integrity and availability of file storage services. This issue stems from the application's failure to properly validate and enforce the Upload-Length header parameter during PATCH requests, creating a scenario where authenticated users can bypass intended size limitations and write arbitrary amounts of data to the target filesystem. The TUS protocol is designed to enable reliable and resumable file uploads by allowing clients to send data in chunks while maintaining state information, but this particular implementation defect undermines the fundamental security controls that should prevent unauthorized data consumption.
The technical flaw manifests when an authenticated user submits a PATCH request to the TUS endpoint with a declared Upload-Length header value that is significantly smaller than the actual request body size. The application processes the request and accepts all incoming data regardless of the declared limit, effectively allowing attackers to write data that exceeds the specified upload capacity. This behavior creates multiple attack vectors including disk space exhaustion, where malicious actors can continuously send oversized payloads to consume available storage resources until the system becomes unavailable or crashes. The vulnerability operates at the application layer and requires authentication, meaning that only users with valid credentials can exploit this weakness, though this does not mitigate the potential for significant service disruption.
The operational impact of this vulnerability extends beyond simple resource exhaustion to encompass broader security implications for file storage infrastructure. When attackers successfully exploit this flaw, they can cause denial of service conditions by filling disk partitions, potentially leading to system crashes or application instability. The vulnerability affects any authenticated user within the FileBrowser environment, meaning that even legitimate users who should not have unlimited upload capabilities can abuse this functionality. This creates a risk for organizations relying on FileBrowser for file management where unauthorized data consumption could lead to service unavailability, data loss, or performance degradation that impacts business operations and user experience.
Security controls that should normally prevent such behavior include proper input validation, size enforcement mechanisms, and resource monitoring systems that track upload activities and alert administrators to unusual consumption patterns. The flaw aligns with CWE-129 weakness category related to insufficient validation of length of input data, specifically targeting the improper handling of user-supplied information in web applications. From an attack framework perspective, this vulnerability maps to multiple MITRE ATT&CK tactics including privilege escalation through resource exhaustion, and potentially to lateral movement if the compromised system serves as a gateway for further attacks. Organizations should implement immediate mitigations including upgrading to FileBrowser version 2.63.19 or later, implementing additional monitoring controls, and establishing automated alerts for unusual upload patterns that could indicate exploitation attempts.
The vulnerability demonstrates how seemingly minor implementation flaws in web application protocols can create significant security risks when proper validation controls are absent. It underscores the importance of comprehensive input validation and adherence to secure coding practices in file handling operations. Organizations using FileBrowser or similar applications should conduct thorough security assessments of their file upload mechanisms and ensure that all components properly enforce size limits and validate user inputs against declared parameters. Regular security updates and vulnerability management processes become critical in preventing exploitation of such weaknesses that can compromise system availability and integrity through seemingly benign functionality.