Filerise CVE-2026-33070

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects a network-accessible vulnerability with high attack complexity and low impact, yielding a score of 3.7. However, this scoring underestimates real-world risk because the attack complexity is high primarily due to the need to discover or guess share tokens—not due to exploit difficulty. Once a valid token is obtained (trivially, as share tokens are often transmitted in URLs or logs), exploitation requires only a single HTTP POST request with no user interaction. The published GitHub advisory provides explicit technical details and likely proof-of-concept code, reducing exploitation barriers substantially. The automatable nature of the attack (batch deletion of share links via token enumeration or collection) and the direct impact on availability for legitimate users sharing files elevates practical risk above the CVSS score suggests. This is a real priority for FileRise users who rely on share link functionality.

An attacker who gains knowledge of a file share token (through URL interception, log exposure, or social engineering) can craft a simple HTTP POST request to /api/file/deleteShareLink.php with that token as a parameter, immediately invalidating the share link without any authentication. For example, a malicious actor could systematically enumerate or collect share tokens from a target organization and then perform batch deletion attacks to disable file sharing for critical business processes. The attack requires only network access and knowledge of valid share tokens; no user interaction or CSRF cooperation is needed, making it trivial to automate and scale.