Description
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.
Published: 2026-08-14
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

FileBrowser versions prior to 2.63.19 do not enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint. As a result, authenticated users can submit request bodies that exceed the specified length and cause the application to write arbitrary, oversized data to disk. This excessive disk usage leads to exhaustion of storage resources and ultimately makes the service unavailable.

Affected Systems

The vulnerability affects the FileBrowser application for all releases before version 2.63.19 released by the filebrowser vendor. Any installation of these earlier editions connected to an authenticated data store is susceptible.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate to high. EPSS data is not provided, and the issue is not listed in the CISA KEV catalog. The attack requires legitimate user credentials, implying an insider, compromised account, or a system with weak access controls. Once exploited, the attacker can consume disk space to render FileBrowser non-functional, causing denial of service and potential data loss.

Generated by OpenCVE AI on August 14, 2026 at 12:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade FileBrowser to version 2.63.19 or later to apply the fix that enforces the Upload-Length header during TUS uploads.
  • Restrict or disable the TUS resumable-upload PATCH endpoint for authenticated users who do not require large file uploads, or impose a hard limit on upload size to prevent disk consumption beyond available space.
  • Implement continuous monitoring of disk space usage on the host running FileBrowser and configure automated alerts or cleanup procedures when usage approaches critical thresholds, mitigating potential denial of service.

Generated by OpenCVE AI on August 14, 2026 at 12:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*

Fri, 14 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Filebrowser
Filebrowser filebrowser
Vendors & Products Filebrowser
Filebrowser filebrowser

Fri, 14 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Description FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.
Title FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Filebrowser Filebrowser
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-17T16:08:39.300Z

Reserved: 2026-08-10T15:13:41.486Z

Link: CVE-2026-72838

cve-icon Vulnrichment

Updated: 2026-08-17T15:46:01.060Z

cve-icon NVD

Status : Received

Published: 2026-08-14T12:16:47.313

Modified: 2026-08-17T16:17:45.667

Link: CVE-2026-72838

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T13:00:11Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling