Description

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-14T12:16:47.313Z",
  "pubdate": "2026-08-14T12:16:47.313Z",
  "executiveSummary": "FileBrowser versions prior to 2.63.19 are affected by a resource exhaustion vulnerability within the TUS resumable-upload PATCH endpoint. The security defect stems from the application's failure to enforce the declared Upload-Length header during data transfer operations.\nThis flaw allows authenticated users to transmit oversized request bodies that deliberately exceed the previously declared upload boundaries. Consequently, the application writes arbitrary data streams to the underlying disk storage until capacity is fully depleted.\nThe primary impact of this vulnerability is a denial of service (DoS) condition, resulting in service unavailability and potential system instability for the host operating system due to unconstrained disk space consumption. The affected product is FileBrowser, specifically all deployments running software versions preceding 2.63.19.\nExploitation of this vulnerability requires authentication, meaning an attacker must possess valid credentials to interact with the TUS upload functionality. The risk implication is significant for multi-tenant or publicly accessible instances where authenticated users can unilaterally compromise system availability and exhaust critical storage resources without requiring advanced privileges.",
  "technicalDetails": "The vulnerability resides in the TUS resumable-upload PATCH endpoint utilized by FileBrowser for handling file transfer streams. The root cause of the security issue is a lack of strict input validation and boundary enforcement regarding the Upload-Length header supplied by the client during initialization versus the actual payload size transmitted during the subsequent PATCH requests.\nThe vulnerable component is the TUS protocol handling mechanism responsible for parsing, validating, and writing incoming data chunks to disk. Affected versions comprise all releases of FileBrowser prior to version 2.63.19. Authentication is required to successfully reach and interact with the endpoint, but no elevated privileges beyond standard authenticated access are necessary to execute the attack.\nThe attack flow proceeds as follows: First, an authenticated attacker initiates a standard resumable upload sequence using the TUS protocol implementation within FileBrowser, declaring a specific and seemingly benign Upload-Length value. Second, instead of adhering to the declared boundary constraint, the attacker issues a PATCH request containing a payload stream significantly larger than the pre-declared length.\nBecause the server-side logic fails to validate the incoming stream against the declared Upload-Length parameter, the application continuously reads and writes the arbitrary data to the underlying storage volume. The payload behavior involves sustained write operations designed to consume maximum available disk blocks.\nAs the storage subsystem becomes completely saturated, the operating system and the FileBrowser application encounter critical I/O failures, leading to application crashes, failure to process legitimate user requests, and a comprehensive denial of service condition. Post-exploitation impact is limited to resource exhaustion and service disruption, as arbitrary code execution is not inherently granted through this specific vector."
}