FileRise EUVD-2026-101673

The /api/file/snippet.php endpoint lacks the standard authenticated-session guard, so unauthenticated requests reach ACL evaluation rather than receiving an immediate 401. Actual file-content disclosure requires an ADDITIONAL non-default condition: an unusual reverse-proxy header configuration OR an ACL misconfiguration that lets the request proceed into path and file-content handling. Limiting factors: on default, correctly-configured FileRise installations the ACL checks block unauthenticated reads, so no arbitrary file read occurs; only short text preview content is exposed (C:L); affects FileRise versions prior to 3.20.0.

All signals converge on LOW real-world risk. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) shows a network-reachable, unauthenticated endpoint but with high attack complexity and only limited confidentiality impact (C:L) and no integrity or availability impact. There is no CISA KEV listing and no public exploit identified, so this is 'no public exploit identified at time of analysis.' No EPSS value was supplied in the input, so exploitation-probability cannot be quantified. The CVSS PR:N (unauthenticated) is technically accurate for reaching the endpoint, but the description is explicit that this does NOT yield an unauthenticated arbitrary file read on normal installations - FileRise's ACL checks still run, so the practical effect is only that unauthenticated requests reach ACL evaluation instead of an immediate 401. Actual file-content disclosure is documented ONLY under additional unusual proxy-header or ACL misconfiguration, which is exactly why AC:H is justified. There is no SSVC decision data in the input. Net: this is a defense-in-depth hardening fix (missing authenticated-session guard), not a high-priority exploitable information-disclosure flaw; the low CVSS and absence of KEV/POC are mutually consistent rather than conflicting.

On a FileRise instance deployed behind a reverse proxy with unusual proxy-header handling or a mis-set ACL, an unauthenticated attacker sends a crafted request to /api/file/snippet.php, which - lacking the authenticated-session guard - proceeds past ACL evaluation into path and file-content handling and returns a short text preview of a file. On a default, correctly-configured installation the ACL check blocks this, so no file content is returned. No public proof-of-concept exploit has been identified.