Executive brief
filebrowser is a web-based file management system that allows users to upload files via a TUS protocol handler. A race condition in the concurrent upload processing allows authenticated users to upload files larger than the declared size limit, potentially exhausting storage and bypassing intended upload restrictions. The vulnerability also triggers file completion hooks incorrectly for oversized files.
Technical details
The vulnerability is a time-of-check time-of-use (TOCTOU) race condition in the TUS PATCH upload handler (http/tus_handlers.go:237–291). The handler checks if file.Size matches the declared Upload-Offset, then opens the file in append mode and writes the request body. However, multiple concurrent PATCH requests at the same offset all observe file.Size == 0 and pass the conflict check before any write completes, allowing each to append their full body to the file. The resulting file can be N× the declared Upload-Length for N concurrent requests. Exploitation requires network access and authentication with create permission. No serialization, mutex, or offset tracking exists in the stat→check→write window. The project is no longer maintained and no fix will ship; workarounds include rate-limiting or serializing PATCH requests at a reverse proxy.
Affected products
- filebrowser filebrowser >= 2.24.0, <= 2.63.23
Timeline
- 2026-08-28: disclosed: Security advisory published
- 2026-08-31: other: Project archived by owner