Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-72838

FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

filebrowser filebrowser

Default version status: unaffected

  • 0 to < 2.63.19affected
  • 2.63.19unaffected
pkg:golang/github.com/filebrowser/filebrowser/v2

References