What is the CVSS score of CVE-2026-25231?

CVE-2026-25231 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Filerise are affected by CVE-2026-25231?

FileRise installations running versions prior to 3.3.0 are exposed to unauthenticated file read attacks, allowing attackers to access sensitive documents stored in the /uploads directory without…

Is there a public PoC exploit available for CVE-2026-25231?

Yes, a public proof-of-concept exploit is available for CVE-2026-25231. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25231?

Within 24 hours: Identify all FileRise instances in your environment and document their versions and network exposure. Within 7 days: Implement network-level access controls to restrict unauthorized access to FileRise /uploads directories, and enable detailed logging of file access attempts. Within 30 days: Upgrade FileRise to version 3.3.0 or later once the patch is released, or migrate to an alternative file management solution if upgrade timeline is uncertain.

Filerise CVE-2026-25231

HIGH

Improper Access Control (CWE-284)

2026-02-09 security-advisories@github.com

Authentication Bypass Information Disclosure Filerise

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 19, 2026 - 19:31 vuln.today

Public exploit code

CVE Published

Feb 09, 2026 - 20:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.

AnalysisAI

Unauthenticated directory traversal in FileRise prior to version 3.3.0 allows remote attackers to read arbitrary files from the /uploads directory without authentication by directly accessing guessable file paths. Public exploit code exists for this vulnerability, enabling attackers to expose sensitive data and breach user privacy. No patch is currently available.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects Filerise. FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.