EUVD-2026-101688Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate, authentication-gated integrity risk rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) indicates a network-reachable, low-complexity attack requiring low privileges and no user interaction, with high integrity impact but no confidentiality or availability impact - consistent with a path-traversal file-write (CWE-22). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so exploitation likelihood signals are absent: there is no public exploit identified at time of analysis and no evidence of active exploitation. The PR:L requirement is corroborated by the description, which explicitly demands an authenticated non-administrator session, a valid CSRF token, and inherited edit permission on a legitimate ancestor folder - meaning this is not a pre-auth mass-exploitable flaw but a privilege-boundary escape usable by an already-authenticated low-privileged user. The combination of real integrity impact (write outside the authorized folder, and potentially outside the WebDAV root where backend credentials allow) against a confirmed-patched flaw makes this a 'patch promptly' item for anyone running FileRise 3.22.0, but the low real-world deployment footprint and the authentication prerequisite argue against treating it as a widespread critical threat. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Path traversal in FileRise 3.22.0 allows an authenticated non-administrator whose session holds inherited edit permission on a legitimate ancestor folder to supply dot and dot-dot segments through the /api/file/saveFile.php folder input, causing attacker-controlled files to be written outside the authorized folder and, where backend credentials permit, outside the configured WebDAV root. Exploitation requires a valid CSRF token plus an authenticated session with inherited edit rights (CVSS 3.1: 6.5, AV:N/AC:L/PR:L/UI:N, I:H only), and no public exploit identified at time of analysis; this is a moderate, authentication-gated integrity risk rather than a top-tier emergency. Vendor-released patch: 3.23.0.
RemediationAI
Upgrade FileRise to version 3.23.0, the vendor-released patch that rejects '.' and '..' segments before ACL evaluation, enforces boundary-aware containment before directory creation, and blocks WebDAV writes from escaping the configured root; upgrade artifacts are at https://github.com/error311/FileRise/releases/tag/v3.23.0 and the advisory is at https://github.com/error311/FileRise/security/advisories/GHSA-67p9-5q8f-586q, with the code change at https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a. If immediate upgrading is not possible, reduce exposure by replacing broad inherited edit permissions with direct per-folder grants so no non-administrator inherits edit rights on an ancestor of a sensitive path, at the cost of more administrative overhead and possible workflow disruption for shared team folders; and restrict or temporarily disable the WebDAV adapter, or re-issue its backend credentials as least-privilege credentials scoped to a dedicated, isolated root with no sensitive sibling directories, which limits escape beyond the configured root but does not stop writes inside the local storage root, so it should be treated as a partial mitigation only. Monitoring for unexpected file creation in parent directories and near-prefixed sibling directories of configured storage roots provides detection but no prevention, and no configuration flag in the supplied data disables the vulnerable save path, so the version 3.23.0 upgrade remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is CWE-22 (improper limitation of a pathname to a restricted directory), rooted in the order of operations inside /api/file/saveFile.php: the attacker-controlled folder value is parsed and ACL inheritance is evaluated against the uncanonicalized string before any normalization, so a path such as a valid ancestor folder plus a '..' segment passes the authorization check that a canonicalized path would fail. Only afterward does the storage layer resolve the segments as ordinary path navigation - the local filesystem adapter did so after creating directories but before a final containment validation, and its containment check used a naive prefix comparison that also accepted similarly named sibling roots (for example a storage root and a lexicographically prefixed sibling directory), while the WebDAV adapter could walk above the configured source root. Version 3.23.0 addresses the class of issue by tightening REGEX_FOLDER_NAME to reject raw or encoded '.' and '..' path segments before ACL evaluation or storage access, applying boundary-aware containment before directory creation for local writes, and preventing WebDAV operations from escaping the configured source root; the same release also hardens upload/rename filename handling, archive extraction, ONLYOFFICE callbacks, and OIDC identity binding.
Know when Filerise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. With an authenticated non-administrator session, a valid CSRF token, and inherited edit permission on a legitimate ancestor, the local filesystem or WebDAV adapter later resolves those segments as path navigation, permitting attacker-controlled file creation outside the authorized folder and, where backend credentials permit, outside the configured WebDAV root. Local storage also created directories before final containment validation and used a prefix comparison that accepted similarly named sibling roots. This issue is fixed in version 3.23.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Unauthenticated directory traversal in FileRise prior to version 3.3.0 allows remote attackers to read arbitrary files f
Unauthenticated administrator account takeover in FileRise before 3.16.0 is possible via a path traversal flaw in the sh
Stored cross-site scripting in FileRise versions before 2.2.3 allows an authenticated user with upload rights to embed J
FileRise versions before 3.3.0 contain an HTML injection vulnerability that allows authenticated users to manipulate the
File overwrite in FileRise prior to 3.18.0 allows an unauthenticated visitor who holds a valid upload-enabled shared-fol
FileRise, a self-hosted web file manager and WebDAV server, contains a critical hardcoded encryption key vulnerability i
Authentication bypass in FileRise (CWE-290) lets unauthenticated remote attackers impersonate any account - including an
Online second-factor guessing against FileRise releases prior to 3.23.0 is permitted well beyond the intended limit beca
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid usern
Authentication bypass in FileRise versions before 3.23.0 lets a remote attacker log in as an existing local account - in
FileRise, a self-hosted web file manager and WebDAV server, contains a path traversal vulnerability in its Resumable.js
FileRise 1.4.0 exposes folder visibility and ownership decisions to authenticated low-privilege users because a regressi
Exploit-DB