Skip to main content

FileBrowser CVE-2026-72838

| EUVDEUVD-2026-58652 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-08-14 VulnCheck GHSA-4fmc-f52r-93hm
Denial Of Service Filebrowser
7.1
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-accessible endpoint exploitable by any authenticated low-privilege user (PR:L), no scope change, causing full availability impact via disk exhaustion with no C or I consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 14, 2026 - 12:22 vuln.today
Analysis Generated
Aug 14, 2026 - 12:22 vuln.today
CVE Published
Aug 14, 2026 - 11:35 cve.org
HIGH 7.1

DescriptionCVE.org

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.

AnalysisAI

FileBrowser versions before 2.63.19 fail to enforce the TUS Upload-Length boundary in the PATCH resumable-upload endpoint, enabling authenticated users to stream arbitrarily large request bodies directly to disk regardless of the length declared at upload creation. The root cause, confirmed by the patch diff, is an unbounded io.Copy call that passed r.Body directly to the target file without capping reads to the remaining declared bytes. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege FileBrowser account
Delivery
Initiate TUS upload with minimal declared length
Exploit
Send oversized PATCH body to upload endpoint
Execution
Server writes unbounded bytes to disk
Persist
Exhaust filesystem capacity
Impact
Cause service unavailability
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated FileBrowser user account at any privilege level - the CVSS PR:L metric confirms low-privilege authentication is sufficient and unauthenticated access is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) yielding a score of 7.1 accurately characterizes this vulnerability: network-accessible, low-complexity exploitation by an authenticated user causing high availability impact with no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid FileBrowser user account initiates a TUS upload session declaring a small Upload-Length (e.g., 1024 bytes), then issues a PATCH request to the upload endpoint with a request body of several gigabytes. Because unpatched versions perform io.Copy without bounding the read, all incoming bytes are written to disk. …
Remediation Upgrade FileBrowser to version 2.63.19 or later, which enforces the TUS Upload-Length constraint by capping disk writes with io.LimitReader and rolling back partial writes that exceed the declared length. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, audit all FileBrowser deployments to identify instances running versions before 2.63.19 and prioritize them for remediation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Filebrowser

View all
CVE-2026-29188 CRITICAL POC
9.1 Mar 05

Unauthorized file operations in File Browser before fix. PoC and patch available.
CVE-2023-39612 CRITICAL POC
9.0 Sep 16

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
CVE-2026-25890 HIGH POC
8.1 Feb 09

Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
CVE-2025-52995 HIGH POC
8.0 Jun 30

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2026-73611 HIGH POC
7.6 Aug 13

File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
CVE-2025-52902 HIGH POC
7.6 Jun 26

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2026-73613 HIGH POC
7.2 Aug 13

Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
CVE-2026-28492 MEDIUM POC
6.5 Mar 05

File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
CVE-2025-52997 MEDIUM POC
5.9 Jun 30

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2025-52900 MEDIUM POC
5.5 Jun 26

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2026-25889 MEDIUM POC
5.4 Feb 09

Filebrowser versions prior to 2.57.1 allow authenticated users to reset passwords without verifying the current password
CVE-2026-48777 CRITICAL
9.3 Jun 16

Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta all

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-72838 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy