CVE-2026-82238lowCWE-367

CVE-2026-82238: low-severity vulnerability in filebrowser

filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads

Published · Updated

Follow this CVE+ Monitor filebrowser

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.3epss 0.2%
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
filebrowser · filebrowser
Related CVEs — filebrowser

In the same product, most dangerous first.

CVE-2026-32759MEDIUMFile Browser TUS Negative Upload-Length Fires Post-Upload Hooks PrematurelyEPSS 1.9%CVE-2026-35585HIGHFile Browser has a Command Injection via Hook RunnerEPSS 1.9%CVE-2025-52903HIGHFile Browser Allows Execution of Shell Commands That Can Spawn Other CommandsEPSS 1.2%CVE-2025-52904HIGHFile Browser: Command Execution not Limited to ScopeEPSS 1.1%CVE-2026-54088CRITICALFile Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)EPSS 0.8%CVE-2026-34528HIGHFile Browser's Signup Grants Execution Permissions When Default Permissions Includes ExecutionEPSS 0.7%