CVE-2026-82238
Received Received - Intake

Race Condition in FileBrowser TUS Upload Handler Allows File Oversize

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-82238
EUVD
EUVD-2026-67690

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser 2.24.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in the TUS upload handler of filebrowser version 2.24.0. Authenticated users can exploit it by sending multiple concurrent PATCH requests at the same offset to bypass file size limits. This allows writing past the declared Upload-Length, creating oversized files and triggering completion hooks for files larger than intended.

Detection Guidance

Detecting this vulnerability requires monitoring for concurrent PATCH requests to the TUS upload endpoint in filebrowser versions 2.24.0. Check server logs for multiple simultaneous requests to the same upload URL with overlapping offsets. Look for requests with identical upload URLs and concurrent timestamps.

Impact Analysis

An attacker with authenticated access could upload files larger than intended, potentially consuming excessive server storage or triggering unintended actions tied to file completion hooks. This may lead to denial of service or unexpected system behavior.

Mitigation Strategies

Upgrade filebrowser to a version later than 2.24.0 where the race condition is fixed. If immediate upgrade is not possible, disable TUS upload functionality or restrict authenticated user access to upload endpoints until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82238. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart