Medium severity6.5NVD Advisory· Published Aug 14, 2026

CVE-2026-72838

Description

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Filebrowser/Filebrowserllm-fuzzy
Range: <2.63.19

Patches

Vulnerability mechanics

References

github.com/filebrowser/filebrowser/commit/4daddec6f200b03a721197d8c0b4b652c994894envd
github.com/filebrowser/filebrowser/security/advisories/GHSA-ffv3-7h97-993qnvd
www.vulncheck.com/advisories/filebrowser-before-disk-exhaustion-via-tus-uploadnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000