LOW 2.3 NVD
CVE-2026-82238
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.
References
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4r8p-gqj2-mwgm
- https://www.vulncheck.com/advisories/filebrowser-2.24.0-race-condition-via-tus-concurrent-
This low severity vulnerability with a CVSS score of 2.3 was published on 2026-08-28 via NVD.
vulnfeed aggregates 11493 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.