Is CVE-2026-32759 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32759 being exploited in the wild.

How severe is CVE-2026-32759?

High severity, with a CVSS score of 8.1, published 20 March 2026.

Which products and versions are affected?

File Browser < 2.33.8, 2.x branch prior to 2.33.8; also reported as <= 2.61.2; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) < 2.33.8, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.33.8.

Is there a fix for CVE-2026-32759?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32759 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-32759?

Check whether you run File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32759: File Browser improper validation in TUS upload handler

Q: Which products and versions are affected?

File Browser < 2.33.8, 2.x branch prior to 2.33.8; also reported as <= 2.61.2; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) < 2.33.8, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.33.8.

Q: Is there a fix for CVE-2026-32759?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-32759 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-32759?

Check whether you run File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32759 · Severity: high · CVSS 8.1 · Published 2026-03-20

File Browser, a web-based file management interface, contains a flaw in how it handles resumable file uploads. An authorized user can bypass upload requirements to trick the server into thinking a file transfer is complete when it is actually empty. This allows an attacker to repeatedly trigger automated server actions (hooks), potentially leading to system exhaustion, data corruption in connected databases, or even remote command execution if the server is configured to run scripts after uploads.

Technologies: File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, FileBrowser, Go.

Quick answers

Is CVE-2026-32759 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32759 being exploited in the wild.
How severe is CVE-2026-32759?: High severity, with a CVSS score of 8.1, published 20 March 2026.
Which products and versions are affected?: File Browser < 2.33.8, 2.x branch prior to 2.33.8; also reported as <= 2.61.2; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) < 2.33.8, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.33.8.
Is there a fix for CVE-2026-32759?: Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32759 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-32759?: Check whether you run File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.8 or later
```
go get github.com/filebrowser/filebrowser/v2@v2.33.8
```

Technical details

The TUS resumable upload handler in File Browser fails to validate that the 'Upload-Length' header is non-negative. It parses this header as a signed 64-bit integer; by providing a negative value (e.g., -1), an authenticated attacker can satisfy the completion condition (newOffset >= uploadLength) during the first PATCH request because the offset (0) is greater than the negative length. This causes the 'after_upload' exec hooks to fire immediately for empty or partial files. If 'enableExec' is active, this can be used to amplify command injection via malicious filenames or cause a Denial of Service by repeatedly triggering resource-intensive hooks. The feature has been disabled by default in version 2.33.8 and later.

Affected products

File Browser File Browser 2.x branch prior to 2.33.8; also reported as <= 2.61.2

Identifiers

CVE-2026-32759
GHSA-ffx7-75gc-jg7c
GO-2026-4713

Timeline

2026-03-14: advisory: GitHub Security Advisory GHSA-ffx7-75gc-jg7c published
2026-03-20: disclosed: NVD publication date
2025-06-25: other: Project maintainers decided to disable the affected feature by default due to ongoing security issues

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.