CVE-2026-32759

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

File Browser versions on the 2.x branch prior to 2.33.8 contain an integer handling flaw in the TUS resumable upload handler at the /api/tus endpoint. The handler treats the Upload-Length header value as a signed 64-bit integer without enforcing a non-negative constraint, so an authenticated user can supply a negative length that immediately satisfies the completion condition on the first PATCH request. This causes the server to invoke any configured after_upload exec hooks against empty or partial files and to create inconsistent cache entries marking nonexistent uploads as complete. The enableExec flag, which is required for hook execution, amplifies the effect from cache corruption to potential command injection or workflow abuse such as S3 ingestion or database writes.

An authenticated attacker can repeatedly trigger the flaw with arbitrary filenames to force expensive hook processing for denial of service, to amplify command injection when malicious filenames reach exec hooks, or to poison downstream upload-driven pipelines. The vulnerability affects all deployments that expose the TUS endpoint, though successful exploitation still requires the instance administrator to have enabled the exec feature despite its documented risks.

The referenced GitHub security advisory and issue tracker indicate that version 2.33.8 disables the exec feature by default for both new and existing installations, thereby removing the pathway to remote command execution while leaving only the lower-severity cache inconsistency.

EPSS for this CVE rose from a low baseline of 0.0015 to a peak of 0.0101, indicating that exploitation interest increased after disclosure and that the issue merits renewed attention.