Authenticated users can write arbitrary data to disk because the software fails to enforce the declared `Upload-Length` in the TUS resumable-upload PATCH endpoint. This allows attackers to send oversized request bodies that exceed the declared upload length, potentially exhausting available disk space and causing service unavailability.