FileRise EUVD-2026-97978

Exploitation requires (1) a victim with an active, authenticated FileRise session, and (2) that victim being lured to attacker-controlled content that issues a forged POST to /api/file/createFile.php or /api/file/createShareLink.php (UI:R). The decisive limiting factor named in the description is the default SameSite=Lax session cookie: a standard scripted cross-site POST will not transmit the session cookie, so a practical attack must use a top-level navigation request (e.g., form auto-submit causing navigation) or rely on a deployment that has changed the cookie policy to SameSite=None. The vulnerable code path is the absence of a server-side X-CSRF-Token check on these two POST handlers in versions prior to 3.14.0; impact is bounded to creating an empty file or a share link under the victim's permissions, not arbitrary file content upload or account compromise.

This is a genuinely low-priority issue despite being a real, vendor-confirmed CSRF flaw (CWE-352). The input CVSS of 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) already reflects limited impact - integrity-only (I:L), no confidentiality or availability loss - and the single most important mitigating signal is stated directly in the description: the default SameSite=Lax session cookie prevents ordinary cross-site POST requests from carrying the victim's session, sharply reducing real-world reachability. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of exploitation; this is 'no public exploit identified at time of analysis.' A notable tension exists between the CVSS AC:L (low complexity) and the reality that SameSite=Lax forces an attacker into a narrow path (top-level navigation POST, or a non-default cookie configuration), which in practice behaves closer to high attack complexity - I have reflected that in my independent assessment below. The PR:N rating is correct for CSRF in the formal sense (the attacker holds no privileges; the victim is the authenticated party), but defenders should read this as 'rides a logged-in user's session' rather than 'unauthenticated remote takeover.' Net: a legitimate hardening fix worth patching during normal maintenance, not an emergency.

An attacker lures an already-authenticated FileRise user into visiting a malicious web page that auto-submits a forged POST to /api/file/createFile.php or /api/file/createShareLink.php; because the handlers never validate the X-CSRF-Token header, the request executes with the victim's permissions, creating an empty file or a share link. No public exploit code is known, and the default SameSite=Lax session cookie means the forged request generally must arrive via top-level navigation (or a weakened cookie policy) to carry the session, so success is conditional rather than guaranteed.