Filerise
CVE-2026-25230
MEDIUM
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 4.6 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. Exploitation requires authentication. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
FileRise versions before 3.3.0 contain an HTML injection vulnerability that allows authenticated users to manipulate the DOM and inject malicious form or link elements to redirect users or trigger unauthorized actions. Public exploit code exists for this medium-severity flaw, and no patch is currently available. The vulnerability requires user interaction and valid credentials to exploit, limiting its immediate impact but creating risk for organizations running affected FileRise instances.
Earlier versions of this analysis (1)
FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. [CVSS 4.6 MEDIUM]
RemediationAI
Fixed in version 3.3.0.. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Filerise. FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0.
Know when Filerise gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0.
Executive ViewAI
Organizations using FileRise should be aware of moderate risk from CVE-2026-25230, a cross-site scripting vulnerability rated CVSS 4.6. Attackers could inject scripts to steal sessions or perform actions as authenticated users. Proof-of-concept code is publicly available. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: implement CSP headers, enable HttpOnly cookies, deploy WAF XSS rules.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)GitHub Advisory
Unauthenticated directory traversal in FileRise prior to version 3.3.0 allows remote attackers to read arbitrary files f
Unauthenticated administrator account takeover in FileRise before 3.16.0 is possible via a path traversal flaw in the sh
Stored cross-site scripting in FileRise versions before 2.2.3 allows an authenticated user with upload rights to embed J
File overwrite in FileRise prior to 3.18.0 allows an unauthenticated visitor who holds a valid upload-enabled shared-fol
FileRise, a self-hosted web file manager and WebDAV server, contains a critical hardcoded encryption key vulnerability i
Authentication bypass in FileRise (CWE-290) lets unauthenticated remote attackers impersonate any account - including an
Online second-factor guessing against FileRise releases prior to 3.23.0 is permitted well beyond the intended limit beca
Multi-factor authentication bypass in FileRise WebDAV prior to 3.16.0 allows an attacker who already holds a valid usern
Authentication bypass in FileRise versions before 3.23.0 lets a remote attacker log in as an existing local account - in
FileRise, a self-hosted web file manager and WebDAV server, contains a path traversal vulnerability in its Resumable.js
FileRise 1.4.0 exposes folder visibility and ownership decisions to authenticated low-privilege users because a regressi
Low-privilege users of FileRise versions prior to 1.4.0 can view, delete, or modify files owned by other users because t
Exploit-DB