Filerise CVE-2026-33329

Authenticated user with upload permission on FileRise versions 1.0.1 through 3.9.x. Attacker exploits unsanitized resumableIdentifier parameter in Resumable.js chunked upload handler to write arbitrary files or delete directories via path traversal.

The CVSS score of 8.1 (High) reflects network-based exploitation with low complexity requiring only low-level authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The attack requires an authenticated user account with upload permissions, which reduces the attack surface compared to unauthenticated vulnerabilities. The impact is limited to integrity and availability (file write and delete operations) with no confidentiality impact, though filesystem probing provides some information disclosure. No EPSS score is available, but the lack of CISA KEV listing and no reported public exploitation suggests this is not being actively exploited in the wild. The technical impact is significant for affected installations as arbitrary file write can lead to code execution, but the requirement for authenticated access and the niche nature of self-hosted FileRise deployments limits overall real-world exposure. This should be prioritized for patching in environments running FileRise, particularly where upload permissions are granted to less-trusted users.

An authenticated attacker with upload permissions initiates a chunked file upload to FileRise and manipulates the resumableIdentifier parameter to include path traversal sequences such as '../../../var/www/html/shell.php'. This causes FileRise to write the uploaded file chunks outside the intended upload directory, potentially placing a web shell in the document root for remote code execution. The attacker could also trigger the cleanup mechanism to delete critical system directories by crafting malicious identifiers, causing denial of service or system instability.