Vulnerability Description
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/filebrowser/filebrowser/commit/4daddec6f200b03a721197d8c0b4b6
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-ffv3-7h97-99
- https://www.vulncheck.com/advisories/filebrowser-before-disk-exhaustion-via-tus-
FAQ
What is CVE-2026-72838?
CVE-2026-72838 is a vulnerability with a CVSS score of 6.5 (MEDIUM). FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can s...
How severe is CVE-2026-72838?
CVE-2026-72838 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-72838?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.