CVE-2026-57491: CWE-434: Unrestricted Upload of File with Dangerous Type in error311 FileRise

CVE-2026-57491 describes a vulnerability in FileRise, a self-hosted web-based file manager, where the archive extraction functionality does not apply the UploadNamePolicy::isAllowedForWrite() check before extracting ZIP archive entries. This allows an authenticated user with upload and extract permissions to place files with blocked extensions (e.g., PHP-family files) inside a ZIP archive and have them written to disk despite normal upload restrictions. Post-extraction metadata pruning does not remove these blocked files, which may lead to code execution in deployments that execute uploaded content. The vulnerability is resolved in FileRise version 3.16.0.

An authenticated user with upload and extract permissions can bypass filename restrictions by embedding disallowed file types inside ZIP archives, resulting in potentially dangerous files being written to the server. If the deployment executes uploaded content, this can lead to unauthorized code execution. The vulnerability does not affect confidentiality or availability directly but impacts integrity by allowing injection of malicious files.

Upgrade FileRise to version 3.16.0 or later, where the vulnerability is fixed by enforcing filename restrictions before extracting archive contents. Until upgrading, restrict upload and extract permissions to trusted users only and avoid executing uploaded content without validation.