CVE-2026-82238
FileBrowser 2.24.0 through 2.63.23: concurrent TUS PATCH uploads race past the declared Upload-Length - NO FIX WILL SHIP
- Severity
- low
- Affected product
- FileBrowser
- Affected versions
- FileBrowser ≥ 2.24.0, ≤ 2.63.23
- Added to NewScan
- 2026-08-28
- Detected by
- NewScan — free, self-hosted
How NewScan reports it
COMPONENT VERSION RANGE
NewScan fingerprints FileBrowser from its response and reports this CVE when the detected version falls inside the affected range below.
MEASURED 2026-08-28 against filebrowser/filebrowser v2.63.23 on loopback. Split out of the row above by its `ge`, the CVE-2026-72859 precedent: the TUS upload handler this race lives in arrived in 2.24.0, so on anything older the id does not apply. Same unmaintained-project situation as the row above - no patched version exists, so `le` and no `fixed_in`. Concurrent PATCH requests each read and then write the offset without holding a lock, so an authenticated uploader writes past the length the server agreed to accept and consumes storage beyond any quota derived from it. Severity low, matching the 2.3 the advisory carries: it needs an authenticated account with upload rights and buys disk consumption, not access. Version-match only.
References
Scan for this yourself — local, in-band scanning is free.
Get NewScan (FREE) →