Filerise

CVEs (14)

• CVE-2026-44460HigMay 27, 2026
  Error311

  Filerise
  risk 0.41cvss 7.4epss 0.00

  FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP…

• CVE-2026-54414Jun 19, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.01

  FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename() and…

• CVE-2026-33477Mar 26, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint `/api/file/snippet.php` allows an authenticated user with only `read_own` access to a folder to retrieve snippet…

• CVE-2026-33330Mar 24, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows an authenticated user with read-only access to obtain a signed save callbackUrl for a file and then directly forge the…

• CVE-2026-33329Mar 24, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any…

• CVE-2026-33072Mar 20, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing…

• CVE-2026-33071Mar 20, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.01

  FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml, .php5, .htaccess, and other server-side executable types, bypassing the filename validation enforced by the regular…

• CVE-2026-33070Mar 20, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial…

• CVE-2026-25231Feb 9, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any…

• CVE-2026-25230Feb 9, 2026
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This…

• CVE-2025-68116Dec 16, 2025
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site Scripting (XSS) due to unsafe handling of browser-renderable user uploads when served through the sharing and download endpoints. An attacker who can get a…

• CVE-2025-66403Dec 1, 2025
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts…

• CVE-2025-62510Oct 20, 2025
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their…

• CVE-2025-62509Oct 20, 2025
  Error311

  Filerise
  risk 0.00cvss —epss 0.00

  FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRise’s file/folder handling allows low-privilege users to perform unauthorized operations (view/delete/modify) on files…