FileBrowser CVE-2026-72838

Exploitation requires a valid authenticated FileBrowser user account at any privilege level - the CVSS PR:L metric confirms low-privilege authentication is sufficient and unauthenticated access is not possible. The TUS resumable-upload PATCH endpoint must be accessible to the authenticated user, which is the default configuration for any FileBrowser instance with file upload enabled. No special administrative rights, non-default configuration, or specific platform are required beyond having an active session. Exploitation is bounded by network throughput and available disk space: upstream proxies or WAFs enforcing request body size limits (e.g., nginx client_max_body_size) will reduce the per-request impact but do not eliminate the vulnerability if the limit exceeds available disk. No user interaction from a third party is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) yielding a score of 7.1 accurately characterizes this vulnerability: network-accessible, low-complexity exploitation by an authenticated user causing high availability impact with no confidentiality or integrity consequences. The PR:L requirement is the primary mitigating factor - anonymous exploitation is not possible, and an attacker must possess or compromise a FileBrowser account. No EPSS score was provided in the intelligence data; this absence, combined with the lack of a CISA KEV listing and no referenced POC, suggests the vulnerability is not currently being exploited at scale. Nonetheless, even a mid-sized municipal IT team in mielec should treat this as urgent if FileBrowser is internet-exposed with shared or weakly controlled user accounts, since a single authenticated session is sufficient to render the service and any co-located application sharing the disk unavailable. The impact is proportional to the disk size and upload speed - a high-bandwidth connection can exhaust gigabytes in seconds. The CVSS signals and description are fully consistent, with no conflicting data.

An attacker with a valid FileBrowser user account initiates a TUS upload session declaring a small Upload-Length (e.g., 1024 bytes), then issues a PATCH request to the upload endpoint with a request body of several gigabytes. Because unpatched versions perform io.Copy without bounding the read, all incoming bytes are written to disk. Repeating this across multiple concurrent upload sessions can fully exhaust available disk space within minutes, crashing FileBrowser and any other service sharing the underlying filesystem.