CVE-2026-72838: FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileBrowserto a version that resolves this vulnerability.Fixed in 2.63.19 - Compensating control
Mitigate disk exhaustion by restricting/limiting access to the TUS resumable-upload PATCH endpoint so only trusted authenticated users can upload (since affected versions allow authenticated users to write arbitrary data to disk).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72838?
The severity of CVE-2026-72838 is medium with a score of 6.5.
How do I fix CVE-2026-72838?
To fix CVE-2026-72838, upgrade FileBrowser to version 2.63.19 or later.
What does CVE-2026-72838 affect?
CVE-2026-72838 affects versions of FileBrowser prior to 2.63.19.
What type of vulnerability is CVE-2026-72838?
CVE-2026-72838 is a disk exhaustion vulnerability caused by improper handling of upload lengths in the TUS PATCH endpoint.
Who can exploit CVE-2026-72838?
Authenticated users can exploit CVE-2026-72838 by sending oversized request bodies to exhaust disk space.