CVE-2026-77368

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

CVE-2026-77368: Authorization Bypass Through User-Controlled Key

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowedprefixes scoping only when a session is created, letting a low-privilege tenant hijack another tenant's upload session to write content to filer paths their o...

CVE-2026-72838: Allocation of Resources Without Limits or Throttling

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

PT-2026-30329

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.16.1 Description Directus' TUS resumable upload endpoint /files/tus allows any authenticated user with basic file upload permissions to overwrite arbitrary existing files by UUID. The TUS controller performs only...

CVE-2026-32759: Integer Overflow or Wraparound

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions on the 2.x branch prior to 2.33.8, the TUS resumable upload handler parses the Upload-Length header as a signed 64-bit integer without validating th...