FileRise CVE-2026-62664

Requires an authenticated low-privileged FileRise account that holds create or owner permission on the target parent folder, plus a valid CSRF token, and a local storage backend (the patched containment check gates on the isLocal path). The attacker submits folderName values containing '..' segments to POST /api/folder/createFolder.php. Limiting factors: exploitation is bounded to directory creation (no file read or overwrite), the destination must be writable by the web-server OS account, and both authentication and the specific parent-folder permission are mandatory - so this cannot be triggered by anonymous or unprivileged remote users. Fixed in 3.19.0, which rejects '.'/'..' segments and verifies the parent stays inside the configured upload root before creation.

This is a moderate-risk, authenticated path-traversal issue (CWE-22) rather than a drop-everything priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L = 5.4) is internally consistent with the description: network-reachable, low complexity, but requiring low-privileged authentication (PR:L) plus a valid CSRF token and create/owner permission on the parent folder. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no signal of active exploitation; no POC is referenced either, so per the data this is 'no public exploit identified at time of analysis.' The impact is limited to I:L/A:L with C:N - attackers can create (not read or overwrite) directories outside UPLOAD_DIR anywhere the web-server account can write, which can disrupt the filesystem or stage for follow-on abuse but does not directly disclose data. One point to verify: creating directories outside the intended upload root arguably affects resources beyond the component's security scope, so a Scope:Changed rating could be defensible; the vendor/NVD chose S:U and this analysis follows that. Overall: real but gated behind authentication and a specific permission, so it ranks as a hardening/patch-soon item, not an emergency.

A low-privileged but authenticated FileRise user who holds create or owner permission on a parent folder crafts a POST to /api/folder/createFolder.php with a folderName containing dot-dot (..) traversal segments and a valid CSRF token. Because validation checks the whole folderName string but does not reject traversal segments before FolderModel::createFolder() builds the path, the server creates directories outside UPLOAD_DIR wherever the web-server account can write. No public exploit is referenced, but the request is trivial to reproduce manually.