CVE-2026-104107: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in error311 FileRise

FileRise 3.22.0 and earlier contain a path traversal vulnerability (CWE-22) in the /api/file/saveFile.php operation. The vulnerability arises because the application accepts dot (.) and dot-dot (..) segments in the folder input before access control list (ACL) inheritance evaluates the uncanonicalized string. An authenticated non-admin user with a valid CSRF token and inherited edit permission on an ancestor folder can exploit this to create files outside the authorized directory. The local filesystem and WebDAV adapter resolve these segments as path navigation, permitting attacker-controlled file creation outside the intended folder and potentially outside the WebDAV root if backend credentials permit. Additionally, local storage creates directories before final containment validation and uses a prefix comparison that incorrectly accepts similarly named sibling roots. This vulnerability is addressed in version 3.23.0.

An attacker with authenticated non-administrator access and inherited edit permissions can create files outside their authorized directories, potentially leading to unauthorized file manipulation. This could affect data integrity by allowing injection or modification of files beyond the intended scope. There is no direct confidentiality or availability impact reported. Exploitation requires a valid CSRF token and appropriate permissions.

Upgrade FileRise to version 3.23.0 or later, where this path traversal vulnerability has been fixed. No other mitigation is required as the vendor has provided an official fix.