Filerise EUVD-2026-14994

Requires FileRise versions prior to 3.10.0 with ONLYOFFICE integration enabled. Attacker must be an authenticated user with read-only file access. No victim interaction needed. Attacker forges ONLYOFFICE save callback to overwrite files with malicious content.

The CVSS score of 7.1 (High) reflects significant integrity impact with low confidentiality impact and no availability impact. The attack vector is network-based with low complexity, requiring only low-level privileges (authenticated user) and no user interaction (AV:N/AC:L/PR:L/UI:N), making it relatively easy to exploit once an attacker has any authenticated access. However, real-world risk is moderated by several factors: the attacker must already be authenticated to the system, the vulnerability is specific to FileRise installations with ONLYOFFICE integration enabled, and there is no evidence of active exploitation in the wild. The technical impact is primarily data integrity violation rather than system compromise. Organizations using FileRise with ONLYOFFICE should prioritize patching, but this is not a critical drop-everything emergency unless sensitive collaborative documents are heavily used by users with varying permission levels.

An attacker with a valid low-privilege account (read-only access) authenticates to FileRise and navigates to a sensitive document they can view but not modify. They initiate an ONLYOFFICE editing session, which generates a legitimate signed callbackUrl for save operations. The attacker then crafts a direct HTTP POST request to the FileRise server, mimicking an ONLYOFFICE save callback with the captured signed URL, but includes malicious content in the request body. Because FileRise fails to verify write permissions during callback processing, the malicious content overwrites the original file, bypassing the read-only restriction and potentially injecting malware, backdoors, or corrupted data into documents used by privileged users.