CVE-2026-62664: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in error311 FileRise

FileRise versions before 3.19.0 improperly limit pathname input to a restricted directory during folder creation. Although the complete folderName string is validated, dot-dot path segments are not rejected before FolderModel::createFolder() constructs the destination path. An authenticated user with low privileges, a valid CSRF token, and create or owner permission on the parent folder can exploit this by submitting traversal segments to the POST /api/folder/createFolder.php endpoint, resulting in directory creation outside the designated UPLOAD_DIR. This vulnerability is classified as CWE-22 (Path Traversal) and has a CVSS 3.1 base score of 5.4 (medium severity). The vulnerability is remediated in FileRise version 3.19.0.

An attacker with low privileges and valid authentication can create directories outside the intended upload directory, potentially leading to unauthorized file system modifications. The impact includes limited integrity and availability concerns, as indicated by the CVSS vector (no confidentiality impact, low complexity, privileges required, no user interaction, unchanged scope, integrity and availability impacts). There is no indication of confidentiality compromise or active exploitation in the wild.

Upgrade FileRise to version 3.19.0 or later, where this path traversal vulnerability is fixed. No other mitigations are indicated or required according to the available data.