CVE-2026-72838 filebrowser CVE debrief

Who should care

Defenders and administrators of FileBrowser instances should assess exposure and verify versions. They should also review relevant monitoring, detection, and logs for exposed assets that need extra review. Additionally, they should track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

Defenders should prioritize verifying FileBrowser versions before 2.63.19 and assessing disk space exhaustion via TUS upload.

• Authenticated users can write arbitrary data to disk.
• Disk space exhaustion via TUS upload can cause service unavailability.

Technical summary

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. This can lead to disk space exhaustion and service unavailability. The vulnerability is caused by a lack of proper validation of the Upload-Length header in the TUS resumable-upload PATCH endpoint. Attackers can exploit this vulnerability by sending oversized request bodies that exceed the declared upload length. Defenders should prioritize verifying FileBrowser versions before 2.63.19 and assessing disk space exhaustion via TUS upload.

Defensive priority

Defenders should prioritize verifying FileBrowser versions before 2.63.19 and assessing disk space exhaustion via TUS upload.

Recommended defensive actions

• Verify FileBrowser versions before 2.63.19
• Assess disk space exhaustion via TUS upload
• Implement compensating controls for TUS upload
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on FileBrowser versions before 2.63.19 failing to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint. This allows authenticated users to write arbitrary data to disk, potentially leading to disk space exhaustion and service unavailability. Defenders should verify FileBrowser versions and assess disk space exhaustion via TUS upload.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.