FileRise EUVD-2026-101626

Requires ALL of: (1) a public shared-folder link whose subfolder browsing is enabled; (2) a pre-existing symbolic link inside that shared folder pointing to a sibling directory under the upload root; (3) the local storage adapter (the fix only applies the real-path boundary check when $storage->isLocal() is true, indicating the symlink-following path is local-filesystem specific); and (4) possession of a valid share token. Exploitation is limited by High attack complexity - the attacker typically cannot create the required symlink themselves and depends on one already present - and the impact is confined to sibling directories under the upload root, not the whole filesystem. These factors make realistic risk materially lower than the unauthenticated network vector alone would suggest.

This is a medium-severity, low-priority issue in practice. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, base 4.8) signals network reachability and no authentication, but High attack complexity (AC:H) is the dominant limiting factor: exploitation depends on a symbolic link already existing inside the shared folder that points to a sibling directory under the upload root - a condition the share-token holder generally cannot create themselves in a default deployment. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of real-world exploitation. The commit diff confirms the root cause (symlink resolution without enforcing the original shared-folder real-path boundary, CWE-59) and confirms the fix in v3.15.0, so the technical claim is well substantiated. The PR:N in CVSS counts the share token as 'no privilege,' but note the description explicitly requires 'a valid share token' - so exploitation is gated on the attacker first possessing a legitimate share link, which narrows the realistic attacker population to those already granted share access or who can obtain a leaked token. Net: a genuine but constrained information-disclosure/limited-integrity flaw, not an urgent mass-exploitation threat.

An attacker holding a valid public share link (with subfolder browsing enabled) to a FileRise folder that contains a symbolic link pointing to a sibling directory uses the shared-folder listing, direct download, or ZIP-creation feature to traverse the symlink and read files outside the folder that was actually shared. No account login is required beyond the share token, but the attack only succeeds where such a symlink already exists and the local storage adapter is in use. No public exploit identified at time of analysis; the fix commit is public.