CVE-2026-82238: filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads
Published Aug 28, 2026
·Updated
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.
Affected Software
1 affected component
Filebrowser Filebrowser>=undefined
Event History
Aug 28, 2026
CVE Published
via MITRE·10:49 AM
Data Sourced
via MITRE·10:49 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploiting this issue require authentication or user interaction?
An attacker needs authenticated access and must send multiple concurrent TUS PATCH requests at the same upload offset. No separate user interaction is required.