CVE-2026-72838CWE-770denial-of-service

CVE-2026-72838

Medium · published August 14, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00530 · 44.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-14T16:16Z
References (3)
https://github.com/filebrowser/filebrowser/commit/4daddec6f200b03a721197d8c0b4b652c994894e · [email protected]https://github.com/filebrowser/filebrowser/security/advisories/GHSA-ffv3-7h97-993q · [email protected]https://www.vulncheck.com/advisories/filebrowser-before-disk-exhaustion-via-tus-upload · [email protected]
EPSS history
Timeline
  • 14 AUG 11:35Z
    FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
    cvelistv5