Filerise EUVD-2026-13641

The CVSS 3.1 score of 4.3 (Low) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N presents a conflicting signal regarding real-world risk. While the CVSS rating is low due to low integrity impact (I:L) and no confidentiality or availability impact, this underweights the actual threat: authenticated file upload leading to remote code execution is a critical privilege escalation and system compromise vector. The vulnerability requires PR:L (authenticated user), which legitimately reduces risk for tightly-controlled deployments but significantly increases risk for organizations with high user churn or shared credentials. The AC:L (low complexity) and AV:N (network accessible) factors are accurate—exploitation requires only WebDAV client access and knowledge of dangerous extensions. Given that Apache LocationMatch protection is a 'non-default deployment' requirement, organizations without this hardening are at substantially higher risk than the CVSS rating suggests. The absence of confirmed public POC or KEV listing may indicate limited real-world exploitation to date, but the straightforward nature of the attack (uploading a .php file via WebDAV) makes this a moderate practical priority for any FileRise deployment exposed to untrusted authenticated users.

An authenticated user with legitimate WebDAV access to a FileRise instance (e.g., a contractor or employee) uploads a malicious PHP file (e.g., shell.php or shell.phtml) via their WebDAV client, bypassing the validation present in the regular upload interface. If the Apache instance lacks LocationMatch protection to block PHP execution in the upload directory, the attacker navigates to the uploaded file URL and achieves arbitrary code execution with the privileges of the web server process. From there, the attacker can read sensitive files, modify application data, pivot to other systems on the network, or establish persistence. No known public POC exists, but the straightforward nature of the attack (standard WebDAV PUT request with a dangerous filename) means exploitation requires only a WebDAV client and basic protocol knowledge.