CyberRota Analysis
AI-GeneratedThe TUS upload handler in filebrowser versions 2.24.0 and later is vulnerable to a race condition that allows authenticated users to exploit concurrent PATCH requests, enabling them to bypass the Upload-Length validation. This can result in the upload of files that exceed their intended size, potentially triggering unintended behaviors or completion hooks. Organizations using this software should prioritize patching to mitigate the risk of unauthorized file uploads and potential abuse.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads.