FileRise EUVD-2026-37993

Attacker must possess a valid, non-expired, upload-enabled shared-folder link/token for the target FileRise instance - these tokens are by design intended to be shared publicly, so possession does not equate to authentication, but the endpoint /api/folder/uploadToSharedFolder.php is not reachable without one. The target must be running FileRise prior to 3.16.0 with the shared-folder upload feature in use, and must be network-reachable to the attacker. No user interaction, no admin credentials, no second-factor, and no specific platform constraint are required beyond a standard PHP deployment of FileRise.

Risk is high and concrete. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H accurately reflects a network-reachable, unauthenticated, no-interaction primitive that yields full compromise via users.txt overwrite. The 'PR:N' rating is defensible because the required token is, by design, a publicly shareable link rather than an authentication credential - this is the kind of nuance that distinguishes a real priority from a paper tiger. No KEV listing and no public exploit identified at time of analysis temper urgency slightly, but the v3.16.0 release notes publicly describe the bypass ('reject encoded path separators before upload writes'), which makes patch-diffing trivial and shortens the time-to-exploit window. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quoted; treat this as a near-term patching priority for any internet-exposed FileRise instance issuing shared-folder upload links.

An attacker obtains a public upload-enabled shared-folder link (posted on a forum, leaked via search engines, or shared through social channels) and submits a multipart upload to /api/folder/uploadToSharedFolder.php with a filename like '..%2fusers%2fusers.txt' whose body contains a crafted users.txt entry granting the attacker administrator role. The server decodes the name after validation and writes the file outside the upload directory, replacing the user database; the attacker then logs in as administrator and, depending on configuration, leverages the admin UI to achieve remote code execution. No public PoC has been identified at time of analysis, but the patch notes disclose the bypass primitive.