PT-2026-72007

CVE-2026-72838

Published

2026-08-14

Updated

2026-08-17

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19

Description Authenticated users can write arbitrary data to disk because the software fails to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint. This allows attackers to send oversized request bodies that exceed the declared upload length, potentially exhausting available disk space and causing service unavailability.

Recommendations Update to version 2.63.19 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-770: Allocation of Resources Without Limits or Throttling

Related identifiers

CVE-2026-72838