FileBrowser versions prior to 2.63.19 contain a vulnerability in the TUS resumable-upload PATCH endpoint where the declared Upload-Length is not enforced. This allows authenticated users to send oversized request bodies, writing arbitrary data to disk beyond the declared length. The consequence is potential exhaustion of disk space, leading to service unavailability.