Medium severity4.6NVD Advisory· Published Feb 9, 2026· Updated Jun 17, 2026

CVE-2026-25230

Description

FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

FileRise/FileRise2 versions
cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*range: <3.3.0
- (no CPE)range: <3.3.0
Error311/Filerisev5
Range: < 3.3.0

Patches

Vulnerability mechanics

References

github.com/error311/FileRise/security/advisories/GHSA-h8fw-42v6-gfhvnvdExploitVendor Advisory
github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/controllers/FileController.phpnvdProduct
github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/models/FileModel.phpnvdProduct
github.com/error311/FileRise/releases/tag/v3.3.0nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.299
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000