File Browser: stale shares, share cleanup, named-pipe DoS, and TUS race

TL;DR

Four independent weaknesses across File Browser releases cause unintended exposure and service instability. The vendor assigned CVEs for each: CVE-2026-82238 (TUS race), CVE-2026-82237 (stale share link after rename), CVE-2026-82236 (share cleanup omission on delete), CVE-2026-82235 (named pipe DoS in download handlers).

Target & scope

• Affected lines (per vendor advisories):
  • 2.24.0 (TUS) through 2.63.23
  • 2.63.6–2.63.23 (share cleanup)
  • Through 2.63.23 (stale share on rename, named-pipe DoS)

Root causes

• TUS handler accepts concurrent PATCH requests for the same upload id and does not enforce a single writer; interleaving bypasses Upload-Length validation.
• Share links are not invalidated when the target file is renamed; the old share id continues to serve whatever now occupies the path.
• Deleting a file with elevated rights does not traverse and purge public-share state for that inode; replacement content later appears under the old public URL.
• Archive and public download paths attempt to open named pipes without O_NONBLOCK safeguards, causing blocking reads that pin goroutines and degrade service.

Exploitation

Remediation

• Serialize PATCH handling per upload id; reject overlapping writers and recheck offsets/lengths.
• Invalidate or remap shares on rename; include inode/version binding.
• On privileged delete, revoke any public shares associated to the path/inode.
• Open named pipes with O_NONBLOCK; detect and refuse special files in download paths.

Disclosure timeline

Artifacts

• CVE-2026-82238 — https://nvd.nist.gov/vuln/detail/CVE-2026-82238
• CVE-2026-82237 — https://nvd.nist.gov/vuln/detail/CVE-2026-82237
• CVE-2026-82236 — https://nvd.nist.gov/vuln/detail/CVE-2026-82236
• CVE-2026-82235 — https://nvd.nist.gov/vuln/detail/CVE-2026-82235