CVE-2026-54414 is a critical path traversal vulnerability in FileRise before version 3.16.0. The issue exists in the /api/folder/uploadToSharedFolder.php endpoint, where the upload filename is validated using basename and a regex that blocks '/' and '\' but not percent-encoded characters (%). This allows attackers to craft filenames with URL-encoded directory traversal sequences, enabling arbitrary file writes outside the intended directory. Successful exploitation can lead to administrator account takeover. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

An attacker can exploit this vulnerability remotely without authentication to write arbitrary files on the server, leading to full compromise including administrator account takeover. The CVSS score of 9.8 reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the upload endpoint and monitor for suspicious upload activity. Avoid exposing the vulnerable endpoint to untrusted networks.