File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely

The vulnerability stems from insufficient validation of the Upload-Length header within the TUS resumable upload handler. An attacker can craft a malicious PATCH request with a negative Upload-Length value. This bypasses the intended logic, causing the server to prematurely consider the upload complete. Consequently, the configured after_upload hook is executed, regardless of whether a complete or valid file was actually uploaded. This allows an attacker to trigger arbitrary code execution on the server, potentially leading to complete system compromise. The impact is particularly severe as it requires only authentication and upload permissions, making it accessible to a wider range of users within the filebrowser environment.

Organizations using filebrowser/filebrowser/v2 for file management, particularly those with publicly accessible upload endpoints or those who have configured custom after_upload hooks. Shared hosting environments where multiple users share the same filebrowser instance are also at increased risk.

• linux / server:

journalctl -u filebrowser -g 'after_upload' | grep -i 'error' 

• generic web:

curl -I 'http://your-filebrowser-url/upload' -H 'Upload-Length: -1' | grep '200 OK'

1. 2026-03-16Disclosure

   disclosure

1. Réservé2026-03-13
2. Publiée2026-03-16
3. Modifiée2026-03-30
4. EPSS mis à jour2026-03-27

The primary mitigation is to upgrade to a patched version of filebrowser/filebrowser/v2 as soon as it becomes available. Until a patch is released, consider disabling the afterupload hook functionality entirely within the filebrowser configuration. If disabling the hook is not feasible, restrict access to the upload functionality to trusted users only. Implement a Web Application Firewall (WAF) rule to filter out PATCH requests with negative Upload-Length headers. Monitor filebrowser logs for unusual activity, specifically looking for repeated afterupload hook executions with small or zero-byte files.