---
id: CVE-2026-82238
title: >-
  filebrowser from version 2.24.0 contains a race condition in the TUS upload
  handler that allows authenticated users to write past the declared
  Upload-Length by sending concurrent PATCH requests
summary: >-
  filebrowser from version 2.24.0 contains a race condition in the TUS upload
  handler that allows authenticated users to write past the declared
  Upload-Length by sending concurrent PATCH requests. Attackers can send
  multiple simultaneous P…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-367
published: '2026-08-28'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:34:34.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82238'
references:
  - url: >-
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4r8p-gqj2-mwgm
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/filebrowser-2.24.0-race-condition-via-tus-concurrent-patch-uploads
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4r8p-gqj2-mwgm
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00211
epssPercentile: 0.1014
ingestedAt: '2026-09-24T20:51:40.238Z'
---

## Overview

filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.