FileRise CVE-2025-62510

Exploitation requires an authenticated low-privilege FileRise account on a vulnerable v1.4.0 instance; the per-request condition is the v1.4.0 regression where folder visibility/ownership is derived from folder names, so folders whose names match the attacker's username (and, in some cases, other users' folders) become accessible across list, read, write, share, rename, copy/move, zip, and WebDAV code paths. Limiting factors: the attacker must already hold valid credentials (PR:L - not remote-unauthenticated), the instance must be the specific regressed version 1.4.0 (fixed in 1.5.0), and the flaw primarily benefits multi-user deployments - a single-user instance has no other users' content to expose.

This is a credible, upgrade-worthy access-control flaw but not a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) indicates a network-reachable, low-complexity attack that requires an existing low-privilege authenticated account (PR:L) and no user interaction, yielding high confidentiality and integrity impact - consistent with the CWE-280 broken-access-control description. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of active or automated exploitation; exploitation status is best characterized as no public exploit identified at time of analysis. The main signal tension is between the high CVSS (8.1) and the real-world picture: the PR:L requirement means an attacker must already hold a FileRise account, and FileRise is a niche self-hosted product, which constrains mass exploitation despite the network vector. Treat this as a genuine confidentiality/integrity risk on any multi-user FileRise 1.4.0 instance, prioritized by how sensitive the hosted files are and how many low-trust users have accounts, rather than as a wormable internet-wide threat.

A legitimate low-privilege user of a shared FileRise 1.4.0 instance notices that folders whose names match their username are exposed to them, and leverages the name-based ownership inference regression to list, read, and in some cases rename, move, copy, or download folders and files belonging to other users. No public proof-of-concept is known, and no special tooling is required - the attacker simply operates through the normal web/WebDAV interface using their authenticated session, exploiting the low attack complexity (AC:L).