The vulnerability in FileBrowser affects versions before 2.63.19 and involves improper enforcement of the declared Upload-Length in the TUS resumable-upload PATCH endpoint. Authenticated users can exploit this by sending request bodies larger than declared, causing arbitrary data to be written to disk. This can exhaust disk space resources, resulting in denial of service conditions. The CVSS 3.1 score is 6.5, reflecting a high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No patch links or vendor advisories are provided in the input, so patch status is not confirmed.

The vulnerability allows authenticated attackers to write arbitrary data beyond the declared upload length, which can exhaust disk space and cause the FileBrowser service to become unavailable. There is no impact on confidentiality or integrity reported, but availability is severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted users only and monitor disk usage to mitigate potential denial of service from disk exhaustion.