FileRise CVE-2026-57491

Requires an authenticated FileRise account (prior to v3.16.0) that holds BOTH upload AND extract/archive-extraction permissions - a read-only or upload-only account cannot trigger it. The attacker must supply a crafted ZIP containing a filename with a normally-blocked extension (PHP-family). Guaranteed outcome is arbitrary-extension file write; actual code execution is LIMITED to deployments whose web server executes content from the upload/storage directory (e.g., PHP interpreter enabled there) - a non-default, deployment-specific condition. Mixed archives still extract allowed files, so the blocked file simply slips through alongside legitimate content. Limiting factors: authenticated access, explicit extract permission, and server configured to execute uploaded files.

This is a legitimate but conditional medium-severity issue rather than a top-tier emergency. The vendor CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, 6.5) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated account that holds BOTH upload and extract permissions (PR:L), with impact scored as integrity-only (I:H) because arbitrary file write is guaranteed while actual code execution is contingent. The 'RCE' tag and CWE-434 (Unrestricted Upload) overstate certainty - the description explicitly qualifies code execution as occurring only in 'deployments that execute uploaded content,' so C:N/A:N in the base vector is appropriate and the worst-case RCE is a downstream, configuration-dependent outcome. No EPSS score, no CISA KEV listing, and no public exploit/POC are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. Net: a real priority for multi-tenant FileRise instances that grant extract permissions to semi-trusted users AND serve the upload directory through a PHP interpreter, but low urgency for single-admin or non-executing deployments. The RCE claim is the main signal to verify against actual deployment configuration before escalating.

An authenticated FileRise user who has been granted upload and extract permissions crafts a ZIP archive containing a PHP-family file (e.g. shell.php) whose extension would normally be rejected by the upload filename policy, then uploads and extracts it. Because UploadNamePolicy::isAllowedForWrite() is not applied before ZipArchive::extractTo(), the blocked file lands on disk and survives metadata pruning; if the server executes PHP from the storage directory, the attacker then requests the file to run arbitrary code. No public exploit code was identified at time of analysis.