CVE-2026-82238

Name of the Vulnerable Software and Affected Versions filebrowser versions 2.24.0 and later

Description A race condition exists in the TUS upload handler. This allows authenticated users to bypass length validation by sending multiple simultaneous PATCH requests at the same offset, enabling them to write data beyond the declared Upload-Length. This can result in files exceeding their specified size and the triggering of completion hooks for these oversized uploads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.