CVE-2026-54459: CWE-352: Cross-Site Request Forgery (CSRF) in error311 FileRise

FileRise, a self-hosted web-based file manager, prior to version 3.14.0, fails to enforce server-side CSRF token checks on the POST endpoints /api/file/createFile.php and /api/file/createShareLink.php. These endpoints invoke FileController::createFile and FileController::createShareLink without rejecting requests missing a valid X-CSRF-Token header. As a result, an attacker can leverage a logged-in user's session to create empty files or share links without proper authorization. The default SameSite=Lax session cookie setting reduces the risk of cross-site POST requests but does not eliminate it. This vulnerability is addressed in FileRise version 3.14.0.

An attacker can exploit this vulnerability to perform unauthorized file creation or share link creation actions on behalf of an authenticated user. This could lead to unauthorized sharing or creation of files, potentially impacting the integrity of the user's data or sharing settings. There is no impact on confidentiality or availability reported. The risk is reduced by the SameSite=Lax cookie attribute, which limits cross-site POST request reachability.

Upgrade FileRise to version 3.14.0 or later, where this CSRF vulnerability has been fixed by enforcing server-side CSRF token validation on the affected endpoints. Until the upgrade, users should be aware of the risk and consider additional protective measures such as restricting access to trusted networks or using web application firewalls to detect and block CSRF attempts.