CVE-2026-23835
Insecure File Upload in LobeHub Enables Quota Bypass and DoS
Publication date: 2026-01-30
Last updated on: 2026-01-30
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lobehub | lobehub | to 1.143.3 (exc) |
| lobehub | lobehub | 1.143.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in LobeHub versions prior to 1.143.3 involves improper validation of file upload requests in the Knowledge Base > File Upload feature. Attackers can intercept and modify upload request parameters, such as the file name and size, allowing them to upload arbitrary files to unintended filesystem paths and manipulate the reported file size. This enables bypassing upload size restrictions and quotas, leading to unauthorized file uploads and resource misuse. [1]
How can this vulnerability impact me? :
The vulnerability can cause exhaustion of storage and related resources, degraded service availability including failed uploads and delayed content delivery, and temporary suspension of upload functionality for legitimate users. It can also cause financial losses due to discrepancies between actual resource consumption and billing calculations. Additionally, a malicious user can indirectly cause denial of service (DoS) to others sharing the same subscription plan. Excessive unaccounted uploads may distort monitoring metrics and overload downstream systems such as backup, malware scanning, and media processing pipelines, undermining operational stability and service reliability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring and intercepting POST requests to the endpoint `/trpc/lambda/file.createFile?batch=1` and inspecting the upload request parameters, specifically the file name and size fields, for anomalies or unauthorized modifications. Tools like Burp Suite can be used to intercept and analyze these requests. Additionally, checking for discrepancies between reported file sizes and actual storage usage can indicate exploitation. Commands to capture and inspect such traffic might include using network packet capture tools like `tcpdump` or `Wireshark` filtered for the relevant endpoint, for example: `tcpdump -i any -A -s 0 'tcp port 80 or tcp port 443' | grep '/trpc/lambda/file.createFile?batch=1'`. However, specific commands to detect this vulnerability are not detailed in the provided resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade LobeHub to version 1.143.3 or later, where the vulnerability has been patched. This update includes proper validation of upload request parameters to prevent unauthorized file creation and manipulation of file size values. Until the patch is applied, monitoring upload requests for suspicious activity and restricting access to the file upload feature may help reduce risk. [1]