VYPR
← All advisories
Low severity3.7NVD Advisory· Published Mar 20, 2026· Updated Jun 17, 2026

CVE-2026-33070

CVE-2026-33070

Description

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • FileRise/FileRise2 versions
    cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*range: <3.8.0
    • (no CPE)range: <3.8.0
  • Error311/Filerisev5
    Range: < 3.8.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.