FileRise CVE-2026-104109

Exploitation requires ALL of the following: (1) an authenticated non-administrator account holding FileRise 'extract' permission (PR:L); (2) the ability to upload or otherwise place an attacker-controlled ZIP/7z/RAR into a target folder; (3) a PRE-EXISTING symlink in that destination folder pointing to a directory outside the storage root - the advisory explicitly does not establish that FileRise lets the attacker create this symlink, making it the dominant limiting factor; and (4) the FileRise OS process must already hold filesystem write (overwrite) or removal (delete) permission on the external target. Because versions prior to 3.23.0 call ZipArchive::extractTo() against the live destination before validating resolved paths, these conditions together enable overwrite and cleanup-based deletion of files outside the storage root. The combination of required authentication, a non-attacker-controlled symlink precondition, and dependence on host filesystem permissions is why attack complexity is high despite the network vector.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H, base 6.8 Medium) and the description agree with each other: the flaw is network-reachable but gated by high attack complexity and low-privilege authentication. No EPSS probability, CISA KEV entry, or public POC was supplied in the intelligence, so there is no automated-exploitation or in-the-wild signal to push this above its Medium rating. The decisive risk-limiting fact comes from the vendor advisory itself: it does NOT establish that the attacker can create the prerequisite external symlink through FileRise. Exploitation therefore depends on a symlink-to-outside-root already existing in a folder the attacker can write to, plus the FileRise OS process holding write/remove permission on the external target - a chain of preconditions largely outside the attacker's control, which is exactly why AC:H is justified. This is a real, vendor-confirmed and patched integrity/availability issue (arbitrary external file overwrite and deletion via CWE-59 link following during ZIP/7z/RAR extraction), but it reads as a conditional, environment-dependent flaw rather than a mass-exploitable priority. No conflicting signals exist between the CVSS vector and the description; the key caveat is simply that the decisive prerequisite (symlink creation) is unproven, so worst-case claims should be treated with caution.

An authenticated non-administrator with extract permission uploads an attacker-crafted ZIP into a folder that already contains a symlink pointing to a directory outside the storage root. Because FileRise runs ZipArchive::extractTo() against the live destination before validating resolved paths, an ordinary archive entry is written through the symlink, overwriting an external file, and post-extraction cleanup can then delete that external target through the same linked parent. No public exploit identified at time of analysis, and the attack succeeds only where the prerequisite symlink already exists and the FileRise process has the needed filesystem permissions.