CVE-2026-72838

CVE-2026-72838 in FileBrowser's TUS protocol implementation allows authenticated users to exhaust disk space by sending PATCH requests that exceed the Upload-Length declared during upload initialization. The vulnerability isn't a missing feature — it's a collapsed security boundary. The TUS protocol separates upload initialization (where Upload-Length is declared) from upload execution (where bytes are written). FileBrowser implemented this separation but failed to enforce the declared length at the write point. An authenticated user who initializes an upload with a legitimate length can then send PATCH requests exceeding that limit. The system trusts the authenticated session without verifying that write operations honor the parameters that the protocol itself established at init time. This is a protocol adoption failure. TUS was designed for peer-to-peer contexts where clients are assumed honest. FileBrowser adapted it for a web application where authenticated users are privileged actors requiring enforcement, not trust. The developers correctly distinguished authenticated from anonymous access but then treated authenticated users as compliant protocol peers rather than actors whose requests needed boundary enforcement. What makes this CVE significant is the blast radius. FileBrowser owns the storage layer. When that layer exhausts, every concurrent operation fails — reads, downloads, backups, thumbnail generation, metadata indexing. This isn't a scoped DoS; it's a cascade initiator. The CVSS 6.5 framing understates the architectural severity. The deeper pattern here matters. Upload-Length is a parameter declared at init that goes unenforced at execution — and this exact

Reviewed through automated stages and approved by a human before publication.