CVE-2026-72838

MEDIUM 6.5

FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.

CWE	CWE-770
Vendor	filebrowser
Product	filebrowser
Published	Aug 14, 2026

Stay Ahead of the Next One

Get instant alerts for filebrowser filebrowser

Be the first to know when new medium vulnerabilities affecting filebrowser filebrowser are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

filebrowser / filebrowser

0 < 2.63.19

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-ffv3-7h97-993q github.com: https://github.com/filebrowser/filebrowser/commit/4daddec6f200b03a721197d8c0b4b652c994894e vulncheck.com: https://www.vulncheck.com/advisories/filebrowser-before-disk-exhaustion-via-tus-upload

Credits

🔍 GG-Feng hacdias