File Management Interface Vulnerability in File Browser by File Browser

CVE-2026-32759

What is CVE-2026-32759?

The File Browser product, specifically in versions 2.61.2 and below, contains a vulnerability in its file management interface associated with the TUS resumable upload handler. This vulnerability arises from the improper handling of the Upload-Length header, allowing authenticated users to exploit a flaw that permits the submission of negative values. This can lead to the triggering of after_upload exec hooks with empty or partial files, enabling potential denial of service due to excessive resource consumption and severe implications for system integrity when paired with malicious filenames. Even in scenarios where exec hooks are disabled, the negative Upload-Length results in incorrect cache entries, falsely indicating that uploads are complete. This vulnerability affects all deployments that utilize the TUS upload endpoint, with implications for not only command execution but also issues in workflows relying on accurate file uploads.

References