CVE-2026-82238CWE-367

CVE-2026-82238

Low · published August 28, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00211 · 10.8th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2026-08-28T16:16Z
References (3)
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4r8p-gqj2-mwgm · [email protected]https://www.vulncheck.com/advisories/filebrowser-2.24.0-race-condition-via-tus-concurrent-patch-uploads · [email protected]https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4r8p-gqj2-mwgm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads
    cvelistv5