What is the CVSS score of CVE-2026-33330?

CVE-2026-33330 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Filerise are affected by CVE-2026-33330?

CVE-2026-33330 is a broken access control vulnerability in FileRise's ONLYOFFICE integration that allows authenticated read-only users to overwrite files with malicious content by spoofing save…. A patch is available.

How to fix or mitigate CVE-2026-33330?

Within 24 hours: Inventory all FileRise deployments and document current versions. Within 7 days: Upgrade FileRise to version 3.10.0 or later across all production environments. Within 30 days: Audit file modification logs for the past 90 days to detect suspicious callback activity or unauthorized overwrites; review access control assignments for read-only accounts to ensure proper privilege boundaries.

Filerise CVE-2026-33330

EUVD-2026-14994 HIGH

Incorrect Authorization (CWE-863)

2026-03-24 GitHub_M

Authentication Bypass Filerise

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:17 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.10.0

EUVD ID Assigned

Mar 24, 2026 - 19:30 euvd

EUVD-2026-14994

Analysis Generated

Mar 24, 2026 - 19:30 vuln.today

CVE Published

Mar 24, 2026 - 19:15 nvd

HIGH 7.1

DescriptionGitHub Advisory

FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows an authenticated user with read-only access to obtain a signed save callbackUrl for a file and then directly forge the ONLYOFFICE save callback to overwrite that file with attacker-controlled content. This issue has been patched in version 3.10.0.

AnalysisAI

A broken access control vulnerability in FileRise's ONLYOFFICE integration allows authenticated users with read-only permissions to overwrite files with malicious content by forging ONLYOFFICE save callbacks using legitimately obtained signed callbackUrls. FileRise versions prior to 3.10.0 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as read-only user

Exploit

Request signed ONLYOFFICE save callback URL

Execution

Forge ONLYOFFICE save callback request

Impact

Overwrite target file with malicious content