The flaw is a race condition in filebrowser’s TUS upload handling where authenticated users can send concurrent PATCH requests at the same offset. This lets them write data beyond the declared Upload‑Length, causing files to exceed their stated size. The oversized file then triggers completion hooks, which may lead to unexpected processing or resource exhaustion.

filebrowser filebrowser 2.24.0 is affected. No other versions are listed as impacted.

The CVSS score of 2.3 indicates low severity; the EPSS score is not available, and the vulnerability is not in the CISA KEV catalog, which reduces the likelihood of widespread exploitation. An attacker must be authenticated to filebrowser and must be able to send multiple simultaneous PATCH requests, so the attack scenario is limited to users with upload privileges. No public exploit has been documented yet.