An issue exists where authenticated users can bypass chunked-upload size and quota checks by forging `Content-Range` offsets and totals. By sending small chunks to the partial upload endpoint with large declared offsets, an attacker can force the server to create oversized files, leading to disk space exhaustion.