send is not able to attach files

[gadgetusaf]

Vaultwarden Support String

Your environment (Generated via diagnostics page)

• Vaultwarden version: v1.32.0
• Web-vault version: v2024.6.2b
• OS/Arch: linux/x86_64
• Running within a container: true (Base: Debian)
• Environment settings overridden: false
• Uses a reverse proxy: true
• IP Header check: true (X-Forwarded-For)
• Internet access: true
• Internet access via a proxy: false
• DNS Check: true
• Browser/Server Time Check: true
• Server/NTP Time Check: true
• Domain Configuration Check: true
• HTTPS Check: true
• Database type: PostgreSQL
• Database version: PostgreSQL 13.16 (Debian 13.16-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit
• Clients used:
• Reverse proxy and version:
• Other relevant information:

Config (Generated via diagnostics page)

Show Running Config

Environment settings which are overridden:

{
  "_duo_akey": null,
  "_enable_duo": false,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "cid:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_max_conns": 10,
  "database_timeout": 30,
  "database_url": "**********://*********************************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://********************",
  "domain_origin": "*****://********************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 9,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "fido2-vault-credentials",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": "***",
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Gadgetusaf Password Vault",
  "invitations_allowed": true,
  "ip_header": "X-Forwarded-For",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 800000,
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": true,
  "signups_allowed": true,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "******************",
  "smtp_from_name": "Bitwarden Password Manager",
  "smtp_host": "**************",
  "smtp_password": "***",
  "smtp_port": 465,
  "smtp_security": "force_tls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "******************",
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

1.32.0

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

Cloudflair

Host/Server Operating System

Linux

Operating System Version

Ubuntu 22.04

Clients

Web Vault, Browser Extension, Desktop, iOS

Client Version

No response

Steps To Reproduce

1. try to attach a file with send in any client

Expected Result

able to attach file

Actual Result

browser app/extension logs out and requires relogging in to the app/extension

Logs

No response

Screenshots or Videos

No response

Additional Context

No response

[BlackDex]

We need a bit more information. We do not request those items just for the fun it 😉

Please provide logs and screenshots of those events when you try to do this.

[gadgetusaf]

What is the best way to get debug logs?

[BlackDex]

Not specifically debug logs, any log output from Vaultwarden would be good.
Maybe also your reverse proxy logs during these attempts.

There must be something there which provides a reason for this action.

[gadgetusaf]

Found the issue, cloudflare is blocking the connection citing this CVE as a managed rule

https://nvd.nist.gov/vuln/detail/CVE-2020-13443

[BlackDex]

Not sure what this has to do with Vaultwarden.
Since this is not an issue with Vaultwarden it self, ill move this to discussions.

[gadgetusaf]

cloudflare has managed rules, it was blocking atachments in the sends, I added a rule to skip '/api/sends/' for my vaultwarden insstance.

[anxo-outeiral]

For those having the same issue:

I tried the suggested Cloudflare WAF rules to skip /api/sends/ and CVE-2020-13443, but it didn't work for me. I'm on Cloudflare Free.

The logs show the classic pattern — the POST to /api/sends/file/v2 returns 200 OK, but then the send is immediately deleted:

vaultwarden | [2026-06-19 11:25:28.312][request][INFO] POST /api/sends/file/v2
vaultwarden | [2026-06-19 11:25:28.327][response][INFO] (post_send_file_v2) POST /api/sends/file/v2 => 200 OK
vaultwarden | [2026-06-19 11:25:29.958][request][INFO] DELETE /api/sends/ed2e239c-4752-4eb1-aae8-08a0bb6b7f2c
vaultwarden | [2026-06-19 11:25:29.973][response][INFO] (delete_send) DELETE /api/sends/<send_id> => 200 OK

The second POST (the actual file upload to /api/sends//file/<file_id>) never happens — it gets blocked somewhere before even reaching Vaultwarden.

Even with the available skip options configured, the issue persisted. The only solution that worked was disabling the Cloudflare proxy (orange cloud → grey cloud/DNS Only) on the subdomain.

I've also posted the same comment on (#6681) for reference.

If anyone has found a working solution that keeps Cloudflare proxy enabled, please share it. Thanks!