What is the CVSS score of CVE-2026-33071?

CVE-2026-33071 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-33071?

Organizations using versions should be aware of moderate risk from CVE-2026-33071, a unrestricted file upload vulnerability rated CVSS 4.3. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2026-33071?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Review file handling controls.

PHP CVE-2026-33071

EUVD-2026-13641 MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-03-20 GitHub_M

PHP RCE Apache File Upload

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.8.0

EUVD ID Assigned

Mar 20, 2026 - 08:45 euvd

EUVD-2026-13641

Analysis Generated

Mar 20, 2026 - 08:45 vuln.today

CVE Published

Mar 20, 2026 - 08:27 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml, .php5, .htaccess, and other server-side executable types, bypassing the filename validation enforced by the regular upload path. In non-default deployments lacking Apache's LocationMatch protection, this leads to remote code execution. When files are uploaded via WebDAV, the createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php accept the filename directly from the WebDAV client without any validation. In contrast, the regular upload endpoint in UploadModel::upload() validates filenames against REGEX_FILE_NAME. This issue is fixed in version 3.8.0.

AnalysisAI

FileRise, a self-hosted web file manager and WebDAV server, contains an unrestricted file upload vulnerability in its WebDAV endpoint that bypasses filename validation controls present in the regular upload path, allowing authenticated attackers to upload executable file types such as .phtml, .php5, and .htaccess. In non-default Apache configurations lacking LocationMatch protection, this enables remote code execution on the underlying web server. The vulnerability affects FileRise versions prior to 3.8.0 and has been patched; no public exploit code or active KEV listing is currently confirmed, but the presence of a GitHub security advisory indicates vendor acknowledgment of the threat.

Technical ContextAI

FileRise (CPE: cpe:2.3:a:error311:filerise:*:*:*:*:*:*:*:*) implements both HTTP-based file upload and WebDAV protocol support for file management. The vulnerability stems from a CWE-434 (Unrestricted Upload of File with Dangerous Type) flaw wherein the WebDAV implementation—specifically the createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php—directly accepts filenames from WebDAV clients without validation. In contrast, the standard HTTP upload handler (UploadModel::upload()) enforces REGEX_FILE_NAME validation to reject dangerous extensions. The root cause is inconsistent input validation across two upload paths, a common architectural weakness. The vulnerability requires Apache as the web server but only manifests in configurations without LocationMatch directives that would otherwise block execution of uploaded files.

RemediationAI

Upgrade FileRise to version 3.8.0 or later immediately, which includes filename validation for the WebDAV upload endpoint matching the restrictions already present in the HTTP upload path. Organizations unable to upgrade immediately should implement Apache LocationMatch directives to prevent execution of uploaded files with dangerous extensions (e.g., .phtml, .php5, .htaccess) in the upload directory, restrict WebDAV access to a minimal set of trusted users via authentication controls, and consider disabling the WebDAV endpoint entirely if not actively required. Monitor FileRise process logs and web server access logs for unusual file uploads via WebDAV with suspicious extensions. Validate the patch application by attempting to upload a .php or .phtml file via WebDAV and confirming rejection. The vendor advisory at https://github.com/error311/FileRise/security/advisories/GHSA-46gv-gf5f-wvr2 provides additional context for remediation planning.