CVE-2026-72838
Received Received - Intake

FileBrowser TUS Upload-Length Bypass Leading to Disk Exhaustion

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: VulnCheck

Description
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-72838
EUVD
EUVD-2026-58652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser to 2.63.19 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FileBrowser versions before 2.63.19 have a flaw in the TUS resumable-upload PATCH endpoint. The server does not enforce the declared upload size (Upload-Length), allowing authenticated users to send oversized request bodies. This causes the server to write more data to disk than intended, potentially exhausting available storage and disrupting service.

Detection Guidance

To detect this vulnerability, monitor disk usage on the FileBrowser server and inspect network traffic for unusually large uploads to the TUS PATCH endpoint (/api/tus/...). Check FileBrowser logs for requests exceeding declared Upload-Length headers. Use tools like netstat or tcpdump to capture suspicious upload patterns.

Impact Analysis

An attacker with file-upload permissions could exploit this to consume excessive disk space, leading to service outages or crashes. This impacts availability and may disrupt normal operations for all users relying on the FileBrowser instance.

Mitigation Strategies

Upgrade FileBrowser to version 2.63.19 or later immediately. If upgrading is not possible, restrict access to the TUS PATCH endpoint (/api/tus/...) via firewall rules or disable TUS uploads entirely. Monitor disk space closely and set up alerts for abnormal usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart