Threats affecting pkg:github/FileRise

FileRise before version 3.28.0 has a privilege escalation vulnerability due to insufficient session expiration and improper session isolation between its WebDAV interface and web application session context. Authenticated low-privilege users can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries, gaining unauthorized read and write access. This occurs because the WebDAV layer inherits elevated privileges from an ambient web session instead of enforcing independent stateless authentication as required by RFC 4918.

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).