CVE-2026-32759: File Browser TUS Negative Upload-Length Causes Premature Hook Execution
Summary
CVE-2026-32759: File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely. Affects github.com/filebrowser/filebrowser/v2 versions < 2.61.1. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-32759 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
File Browser is an open-source file management application that allows users to manage files and directories through a web interface. It supports various functionalities, including file uploads, downloads, and management through a TUS (resumable upload) protocol. The application is designed to be extensible, allowing users to configure hooks that execute after file uploads. However, a vulnerability in the TUS upload handler can lead to unintended behavior when handling negative upload lengths.
Vulnerability Detail
The vulnerability arises from the TUS resumable upload handler's failure to validate the 'Upload-Length' header as a non-negative integer. When a negative value is provided, such as '-1', the upload completion condition is satisfied immediately, allowing the server to execute 'after_upload' hooks with an empty or partial file. This can be exploited by an authenticated user with upload permissions, leading to the potential for denial of service, command injection amplification, and business logic abuse. The vulnerability is rooted in the signed comparison used in the completion check, which incorrectly allows negative upload lengths to trigger the hooks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the execution of 'after_upload' hooks by setting the 'enableExec' flag to false in your configuration. This will prevent any hooks from being triggered until a proper fix is applied.
Conclusion
CVE-2026-32759 is a significant vulnerability in the File Browser's TUS upload handler that can lead to unintended execution of hooks with empty files. Users are advised to update to the latest patched version and consider disabling exec hooks as a temporary measure until a fix is applied.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
The impact includes the potential for denial of service, command injection, and business logic abuse due to the ability to trigger hooks with empty file contents.
All deployments using the TUS upload endpoint in File Browser are affected, especially those with exec hooks enabled.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
Yes, you can disable the execution of 'after_upload' hooks by setting the 'enableExec' flag to false in your configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
