Executive brief
File Browser, a web-based file management interface, contains a flaw in how it handles resumable file uploads. An authorized user can bypass upload requirements to trick the server into thinking a file transfer is complete when it is actually empty. This allows an attacker to repeatedly trigger automated server actions (hooks), potentially leading to system exhaustion, data corruption in connected databases, or even remote command execution if the server is configured to run scripts after uploads.
Technical details
The TUS resumable upload handler in File Browser fails to validate that the 'Upload-Length' header is non-negative. It parses this header as a signed 64-bit integer; by providing a negative value (e.g., -1), an authenticated attacker can satisfy the completion condition (newOffset >= uploadLength) during the first PATCH request because the offset (0) is greater than the negative length. This causes the 'after_upload' exec hooks to fire immediately for empty or partial files. If 'enableExec' is active, this can be used to amplify command injection via malicious filenames or cause a Denial of Service by repeatedly triggering resource-intensive hooks. The feature has been disabled by default in version 2.33.8 and later.
Affected products
- File Browser File Browser 2.x branch prior to 2.33.8; also reported as <= 2.61.2
Timeline
- 2026-03-14: advisory: GitHub Security Advisory GHSA-ffx7-75gc-jg7c published
- 2026-03-20: disclosed: NVD publication date
- 2025-06-25: other: Project maintainers decided to disable the affected feature by default due to ongoing security issues