Executive brief
linx-server is a file upload and sharing application. An attacker can cause a denial of service by sending crafted POST requests that consume temporary disk storage without respecting the configured upload size limit. An attacker can fill the server's temporary storage by sending oversized multipart uploads in parallel, rendering the service unavailable.
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in the uploadPostHandler component. linx-server calls Go's r.FormFile("file") to handle multipart uploads, which automatically spools file content to temporary disk storage during parsing. The application's size limit check (Config.maxSize) is performed after FormFile returns, meaning attackers can force large file content into temporary storage before the size enforcement is applied. The attacker can exploit this by sending POST requests to /upload/ with multipart bodies larger than the configured maximum; the temporary files will be written to disk and only rejected afterward, exhausting temporary storage. No patch has been released as of the advisory date. The attack requires network access to the upload endpoint with no authentication or user interaction needed.
Affected products
- Andrei Marcu linx-server <= 2.3.8
Timeline
- 2026-06-15: disclosed
- 2026-06-15: advisory: Published to GitHub Advisory Database and NVD