CVE-2026-82238
filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads
- State
- Published
- Severity
- 2.3 Low
- Published
- Aug 28, 2026
- Updated
- Sep 30, 2026
- Reserved
- Aug 28, 2026
Description
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.1 Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected Products
| Product | Versions |
|---|---|
filebrowserfilebrowser |
|
References
- GitHub Security Advisory (GHSA-4r8p-gqj2-mwgm)vendor-advisory
- VulnCheck Advisory: filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploadsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.