What is the CVSS score of EUVD-2026-13640?

EUVD-2026-13640 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-13640?

CVE-2026-33070 is a low-severity vulnerability in versions (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate EUVD-2026-13640?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

PHP EUVD-2026-13640

| CVE-2026-33070 LOW

Missing Authentication for Critical Function (CWE-306)

2026-03-20 GitHub_M

PHP Denial Of Service CSRF Authentication Bypass

3.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

3.8.0

EUVD ID Assigned

Mar 20, 2026 - 08:45 euvd

EUVD-2026-13640

Analysis Generated

Mar 20, 2026 - 08:45 vuln.today

CVE Published

Mar 20, 2026 - 08:25 nvd

LOW 3.7

DescriptionGitHub Advisory

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.

AnalysisAI

FileRise, a self-hosted web file manager and WebDAV server, contains a missing-authentication vulnerability in the deleteShareLink endpoint that allows unauthenticated attackers to delete arbitrary file share links by providing only the share token, resulting in denial of service to legitimate users accessing shared files. All versions prior to 3.8.0 are affected. While the CVSS score is moderate at 3.7 due to high attack complexity, the vulnerability has a published proof-of-concept via the GitHub security advisory and represents a trivial attack surface requiring only knowledge of a share token.

Technical ContextAI

FileRise is a PHP-based file management application identified via CPE cpe:2.3:a:error311:filerise:*:*:*:*:*:*:*:*. The vulnerability exists in the POST /api/file/deleteShareLink.php endpoint, which invokes FileController::deleteShareLink() without performing authentication, authorization, or CSRF token validation before executing the share link deletion operation. This represents a classic CWE-306 (Missing Authentication for Critical Function) flaw where a security-sensitive operation is exposed without verifying the caller's identity or session legitimacy. The root cause is the absence of session checks or token validation mechanisms that should guard the deleteShareLink function, allowing any network-reachable client to craft an HTTP POST request with only the share token parameter to destroy links.

RemediationAI

Upgrade FileRise to version 3.8.0 or later immediately, as the patch is available and fully addresses the authentication bypass. Prior to patching, implement a reverse proxy or Web Application Firewall rule to restrict access to the /api/file/deleteShareLink.php endpoint to authenticated users only, and enforce IP allowlisting if possible. Additionally, implement CSRF token validation at the application level and rotate all existing share tokens if the application was deployed in an untrusted network environment. Monitor access logs for repeated POST requests to the deleteShareLink endpoint from unauthenticated sources, as this may indicate active exploitation attempts.