CVE-2026-82238 in Filebrowser
Summary
by MITRE • 08/28/2026
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Filebrowser versions prior to 2.24.0 represents a critical race condition within the TUS resumable upload handler, specifically affecting how file lengths are validated during concurrent operations. The core technical flaw lies in the lack of atomicity when processing multiple PATCH requests that target the same offset simultaneously. In standard HTTP-based uploads using the TUS protocol, clients send data chunks via PATCH requests, each declaring an Upload-Length header to indicate the total size of the final resource. Under normal circumstances, the server validates this length against incoming data and ensures integrity before completing the upload. However, when authenticated users exploit this race condition by dispatching multiple simultaneous PATCH requests at identical offsets, they can bypass these validation checks. The server processes each request independently without sufficient synchronization mechanisms to enforce strict adherence to the declared Upload-Length limit during concurrent execution.
This architectural weakness allows attackers to write data past the boundaries defined in the initial metadata headers. By flooding the handler with parallel requests, an attacker effectively creates a window where multiple writes are committed before any single validation routine can reject the overflow. This results in files being created on the server that exceed their declared size limits. The operational impact of this flaw extends beyond simple data integrity issues; it directly triggers completion hooks associated with oversized uploads. These hooks often execute automated processes such as virus scanning, metadata extraction, or integration workflows. When triggered by maliciously crafted payloads that exploit this race condition, these hooks may process unvalidated or excessively large files, potentially leading to resource exhaustion, denial of service conditions due to disk space consumption, or the execution of unintended logic within downstream systems connected via these webhooks.
From a classification perspective, this vulnerability aligns with CWE-362, which describes concurrent execution using shared resources with improper synchronization. The exploitation technique involves manipulating timing and concurrency controls to bypass security-relevant decisions made during resource access. In terms of the MITRE ATT&CK framework, this behavior is consistent with techniques involving resource manipulation or abuse of API endpoints for unauthorized data handling. While Filebrowser requires authentication, which mitigates some risk vectors associated with unauthenticated attacks, the ability to escalate impact through concurrent request flooding remains a significant concern for environments where file integrity and automated processing are critical.
Mitigation strategies should prioritize upgrading to version 2.24.0 or later, where this race condition has been addressed by implementing proper locking mechanisms or atomic operations within the TUS upload handler. For organizations unable to immediately patch their systems, defensive measures include configuring web server rate limiting to restrict the number of concurrent PATCH requests allowed from a single IP address or user session. Additionally, implementing strict validation logic at the application layer that re-checks file sizes after all chunks are received but before triggering completion hooks can provide an additional layer of defense. Monitoring logs for unusual patterns of high-frequency PATCH requests targeting identical offsets may also aid in early detection and response to potential exploitation attempts.