What is the CVSS score of CVE-2026-33477?

CVE-2026-33477 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33477?

Organizations using versiosn 2.3.7 should be aware of moderate risk from CVE-2026-33477, a incorrect authorization vulnerability rated CVSS 4.3.. A patch is available.

How to fix or mitigate CVE-2026-33477?

Within 30 days: Identify affected systems running versiosn 2.3.7 and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-33477

EUVD-2026-16277 MEDIUM

Incorrect Authorization (CWE-863)

2026-03-26 GitHub_M

PHP File Upload Authentication Bypass

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.11.0

EUVD ID Assigned

Mar 26, 2026 - 17:45 euvd

EUVD-2026-16277

Analysis Generated

Mar 26, 2026 - 17:45 vuln.today

CVE Published

Mar 26, 2026 - 17:09 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint /api/file/snippet.php allows an authenticated user with only read_own access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the read_own enforcement for hover previews. Version 3.11.0 fixes the issue.

AnalysisAI

FileRise versions 2.3.7 through 3.10.0 suffer from improper access control in the file snippet endpoint, allowing authenticated users with read-only access to retrieve file content uploaded by other users in shared folders. An attacker with limited folder permissions can exploit this authorization bypass to view sensitive files beyond their intended access scope. The vulnerability affects FileRise running on PHP and is resolved in version 3.11.0.

Technical ContextAI

FileRise (cpe:2.3:a:error311:filerise) is a self-hosted PHP-based file manager application supporting multi-user collaboration with granular folder-level access controls including read-own permissions. The vulnerability is classified under CWE-863 (Incorrect Authorization), indicating that the /api/file/snippet.php endpoint fails to properly validate whether the authenticated user has authorization to read files created by other users before serving snippet content for preview generation. The read_own access level is intended to restrict users to only their own uploaded files, but the snippet endpoint does not enforce this restriction, allowing lateral file enumeration and content disclosure within shared folders.

RemediationAI

Upgrade FileRise to version 3.11.0 or later immediately, as vendor-released patch version 3.11.0 is confirmed to fix this authorization flaw. Users unable to patch immediately should restrict folder-sharing practices to minimize exposure of sensitive files to users with read_own access, enforce strong authentication for all user accounts, and monitor API access logs for suspicious /api/file/snippet.php requests from low-privileged accounts accessing files outside their own uploads. See vendor advisory at https://github.com/error311/FileRise/security/advisories/GHSA-62wx-vp78-2p83 for detailed patch instructions.