CVE-2026-82238 Overview
CVE-2026-82238 is a race condition vulnerability in filebrowser, an open-source web-based file management application, affecting versions from 2.24.0 onward. The flaw resides in the TUS (resumable upload protocol) handler, where concurrent PATCH requests targeting the same offset can bypass the declared Upload-Length validation. Authenticated users can exploit this weakness to write data past the declared upload size, producing oversized files and triggering post-completion hooks on those files. The underlying weakness is classified as [CWE-367] Time-of-Check Time-of-Use (TOCTOU).
Critical Impact
Authenticated attackers can bypass upload length validation by sending concurrent PATCH requests, causing files to exceed declared size limits and triggering completion hooks against oversized content.
Affected Products
- filebrowser (open-source web file manager)
- filebrowser versions 2.24.0 and later (until patched)
- Deployments exposing the TUS upload endpoint to authenticated users
Discovery Timeline
- 2026-08-28 - CVE-2026-82238 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82238
Vulnerability Analysis
The vulnerability affects the TUS resumable upload handler in filebrowser. TUS uses PATCH requests to append chunks to an in-progress upload identified by an offset. The handler validates that the current write does not exceed the declared Upload-Length before committing bytes. However, this check and the subsequent write are not performed atomically.
When an authenticated user submits multiple PATCH requests concurrently at the same offset, each request independently observes a valid state before the write. All requests then proceed to append data, resulting in a total upload size that exceeds Upload-Length. The upload is marked complete despite violating the size contract, and any registered completion hooks execute against the oversized artifact.
Root Cause
The root cause is a Time-of-Check to Time-of-Use ([CWE-367]) flaw in the TUS PATCH request pipeline. The length verification and the file append operation are separated by a window where concurrent requests can pass the check simultaneously. The handler lacks per-upload locking or atomic offset-and-length reservation, allowing parallel writers to bypass the intended size enforcement.
Attack Vector
Exploitation requires network access to the filebrowser HTTP endpoint and valid authenticated credentials with upload permissions. The attacker initiates a TUS upload with a small Upload-Length value, then issues multiple simultaneous PATCH requests targeting the same starting offset with chunks that individually fit within the declared length. The race window between validation and file write permits all requests to commit, producing a final file larger than declared. Downstream completion hooks, size-based filters, and storage quotas that trust the declared length can then act on unexpected payloads. Refer to the GitHub Security Advisory and the Vulncheck Advisory for Filebrowser for protocol-level detail.
Detection Methods for CVE-2026-82238
Indicators of Compromise
- Stored files whose on-disk size exceeds the Upload-Length header value recorded in TUS metadata.
- Multiple PATCH requests received within a narrow time window targeting the same TUS upload identifier and same Upload-Offset.
- Completion hook executions where the processed file size is greater than the original upload declaration.
Detection Strategies
- Reconstruct TUS upload sessions from HTTP access logs and flag sessions where the number of PATCH requests exceeds the expected chunk count derived from Upload-Length.
- Compare final artifact size on disk against the declared Upload-Length recorded in .info sidecar metadata; report mismatches.
- Alert on concurrent PATCH requests to /api/tus/{id} sharing an identical Upload-Offset header from the same session.
Monitoring Recommendations
- Enable verbose HTTP access logging on the filebrowser reverse proxy including request timestamps at millisecond resolution and TUS headers.
- Monitor storage volume usage for unexpected growth relative to declared upload quotas.
- Audit completion-hook execution logs for oversized inputs or failures caused by unexpected file sizes.
How to Mitigate CVE-2026-82238
Immediate Actions Required
- Upgrade filebrowser to a fixed release as identified in the GitHub Security Advisory.
- Restrict upload permissions to trusted user accounts until the patch is applied.
- Enforce authentication and network-layer access controls on the filebrowser endpoint to reduce the exploitable surface.
Patch Information
Consult the upstream GitHub Security Advisory GHSA-4r8p-gqj2-mwgm for the specific patched version and commit references. Deploy the updated container image or binary across all filebrowser instances, and validate that the TUS handler enforces atomic length checks after the upgrade.
Workarounds
- Disable the TUS upload endpoint if resumable uploads are not required by the deployment.
- Place a reverse proxy in front of filebrowser that serializes or rate-limits concurrent PATCH requests per upload identifier.
- Enforce hard storage quotas at the filesystem or container level so oversized files cannot be written beyond declared limits.
- Review and harden completion hooks to validate actual file size against Upload-Length before processing.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
