FileRise before version 3.16.0 is vulnerable to a path traversal attack in the /api/folder/uploadToSharedFolder.php endpoint. The vulnerability stems from improper validation of the upload filename: the validation uses basename() and a regex that blocks '/' and '\' but not URL-encoded equivalents like '%2f'. The filename is URL-decoded after validation, reintroducing path traversal sequences such as '../'. The policy check for allowed filenames only inspects the final component, allowing traversal sequences to pass. The destination path is used directly in move_uploaded_file() without realpath containment checks, enabling arbitrary file writes outside the intended upload directory. An attacker with a valid, non-expired, upload-enabled shared-folder token can exploit this to overwrite files such as users/users.txt, creating an administrator account and potentially achieving remote code execution depending on configuration. The vulnerability is addressed in version 3.16.0 by URL-decoding before validation and rejecting filenames containing path separators.

Successful exploitation allows an unauthenticated attacker possessing a valid upload-enabled shared-folder token to write arbitrary files outside the designated upload directory. This can lead to administrator account takeover and, depending on the system configuration, remote code execution. The vulnerability compromises confidentiality, integrity, and availability of the affected system.

A fix is available in FileRise version 3.16.0, which properly URL-decodes filenames before validation and rejects any path separators in upload filenames. Users should upgrade to version 3.16.0 or later to remediate this vulnerability. Until upgraded, restrict access to shared-folder upload links and monitor for suspicious activity. Patch status is confirmed fixed in 3.16.0.