PT-2026-25857 · Unknown · Filebrowser

Fg0X0 · Published 2026-03-16 · Updated 2026-03-27 · CVE-2026-32759

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions File Browser versions 2.61.2 and below

Description File Browser has a flaw in its handling of TUS resumable uploads. The software parses the 'Upload-Length' header as a signed 64-bit integer without verifying that the value is non-negative. This allows an authenticated user to provide a negative value, which immediately satisfies the upload completion condition upon the first PATCH request. Consequently, the server triggers 'after upload' execution hooks with empty or partial files. This enables an attacker to repeatedly trigger configured hooks with arbitrary filenames and zero bytes written. The impact ranges from denial of service (DoS) through resource-intensive processing hooks, to command injection amplification when combined with malicious filenames, and abuse of upload-driven workflows. Even without execution hooks enabled, a negative 'Upload-Length' creates inconsistent cache entries where files are marked as complete but contain no data. The issue affects all deployments using the TUS upload endpoint ('/api/tus'), and the 'enableExec' flag escalates the impact from cache inconsistency to remote command execution. The vulnerable code resides in http/tus handlers.go, specifically within the getUploadLength() and tusPatchHandler functions. The completion check uses a signed comparison, meaning any negative uploadLength is always less than newOffset, causing the hook to fire immediately. The API endpoint affected is /api/tus. The vulnerable parameter is Upload-Length.

Recommendations Versions prior to 2.61.2 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2026-32759

GHSA-FFX7-75GC-JG7C

GO-2026-4713

SUSE-SU-2026:1135-1

Affected Products

Filebrowser

References · 150

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32759.json · Exploit
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-ffx7-75gc-jg7c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ffx7-75gc-jg7c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32759 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32759 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4713 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://github.com/filebrowser/filebrowser/issues/5199 · Note
• https://github.com/filebrowser/filebrowser · Note
• https://suse.com/security/cve/CVE-2026-30886 · Note
• https://suse.com/security/cve/CVE-2026-32285 · Note
• https://suse.com/security/cve/CVE-2026-33621 · Note
• https://suse.com/security/cve/CVE-2026-2578 · Note
• https://suse.com/security/cve/CVE-2026-32760 · Note
• https://suse.com/security/cve/CVE-2026-33281 · Note