Description

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-28T12:16:33.737Z",
  "pubdate": "2026-08-28T12:16:33.737Z",
  "executiveSummary": "A race condition vulnerability exists in the TUS upload handler within filebrowser versions 2.24.0 and potentially subsequent iterations. This flaw permits an authenticated user to bypass file size restrictions enforced by the application.\nBy orchestrating concurrent PATCH requests, an attacker can circumvent the declared Upload-Length validation. This allows for the unauthorized creation of files exceeding the intended size limits.\nThe primary risk involves the potential for disk exhaustion or the execution of completion hooks on malicious or oversized payloads that would otherwise be rejected by the system's security policies.\nThe vulnerability is restricted to authenticated users, meaning the attacker must possess a valid session. No remote code execution is directly provided, but the ability to write arbitrary file sizes can be leveraged to trigger downstream processing logic or cause denial-of-service conditions through resource exhaustion.\nExploitation requires precise timing to successfully perform simultaneous requests against the TUS handler. Organizations relying on filebrowser for user-uploaded content are at risk if they rely on size constraints to mitigate abuse or storage-related security threats.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of synchronization within the TUS (a resumable file upload protocol) implementation in filebrowser. Specifically, the state management associated with the 'Upload-Length' header and the current offset during PATCH requests fails to implement adequate locking mechanisms or atomic operations.\nWhen a file upload is initiated, the application validates the provided 'Upload-Length' header against configured storage or quota limits. Under normal conditions, the server tracks the byte offset to ensure no subsequent data packets exceed the pre-defined length. However, the TUS handler in the affected versions does not maintain an atomic view of the file's current state relative to the request stream.\nAn attacker can exploit this by initiating a legitimate upload and subsequently sending multiple concurrent PATCH requests directed at the same byte offsets. Because the server-side validation logic for the total upload length is not mutually exclusive, the concurrent processing threads fail to compare the total accumulated data against the 'Upload-Length' constraint before committing the buffered data to the underlying storage.\nThe attack flow follows these steps: 1) The attacker initiates a TUS upload sequence with a specified 'Upload-Length'. 2) The attacker begins streaming data via a PATCH request. 3) Before the first request completes, the attacker floods the server with multiple parallel PATCH requests. 4) The race condition triggers the handler to accept and append data from these concurrent streams because the individual validation checks operate on stale or non-synchronized state data regarding the total file size. 5) The file system eventually reconciles the data, resulting in a final file size that significantly exceeds the validated threshold.\nThe vulnerable component is the TUS upload handler module. The exploitation allows for the successful writing of oversized files, which subsequently triggers internal system completion hooks—such as file processing, indexing, or external notification scripts—that were not designed to handle files of that magnitude or content type. This can lead to a secondary impact where these hooks consume excessive CPU or memory resources, potentially leading to an application-level denial-of-service."
}