CVE-2026-82238

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.

CVSS 4.0

2.3CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

3.1CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-25)

CWE

CWE-367

Published

2026-08-28

Modified

2026-09-30

Record from

the NVD, synced 2026-10-19

References

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4r8p-gqj2-mwgm
• https://www.vulncheck.com/advisories/filebrowser-2.24.0-race-condition-via-tus-concurrent-patch-uploads
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4r8p-gqj2-mwgm

Check your stackJSON