CVE-2026-61844: CWE-706: Use of Incorrectly-Resolved Name or Reference in error311 FileRise

FileRise is a self-hosted web-based file manager that, before version 3.18.0, flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens. This causes distinct folders such as 'team/docs' and 'team-docs' to share a single metadata file. Since uploader metadata authorizes read_own and ownership-restricted edits, a low-privileged user who controls one folder with a colliding metadata filename, knows the target basename, and has read_own access to the target folder can alter the metadata. This manipulation can make the victim file appear attacker-owned, allowing the attacker to read and modify the file if edit-own permission is available. The vulnerability is addressed in FileRise version 3.18.0.

An attacker with low privileges and control over a folder with a colliding metadata filename can manipulate metadata to gain unauthorized read and write access to files in another folder. This can lead to unauthorized disclosure and modification of files, impacting confidentiality and integrity. The CVSS score of 7.1 reflects a high severity with network attack vector, high impact on confidentiality and integrity, and low privileges required.

Upgrade FileRise to version 3.18.0 or later, where this metadata filename collision issue is fixed. No other mitigation is indicated or required as the vendor has provided an official fix.