CVE-2026-104109 is a vulnerability in FileRise, a self-hosted web-based file manager, affecting versions prior to 3.23.0. The issue involves improper link resolution before file extraction, allowing an authenticated non-administrator with extract permission to overwrite or delete files outside the intended storage root if a symlink exists. The vulnerability is fixed in version 3.23.0.
FileRise 3.22.0 contains a path traversal vulnerability in the /api/file/saveFile.php endpoint. Authenticated users with inherited edit permissions and a valid CSRF token can exploit this flaw to create files outside authorized directories by using dot and dot-dot path segments. The issue arises because the application evaluates uncanonicalized folder input before access control checks and improperly validates directory containment. This vulnerability is fixed in version 3.23.0.
FileRise Pro versions prior to 3.24.0 contain a vulnerability where the /api/pro/portals/get.php endpoint exposes sensitive internal client portal information to unauthenticated users who know or guess the portal slug. This includes internal storage paths, client emails, form settings, and upload policies. The issue requires the Pro add-on and at least one configured portal. It is fixed in version 3.24.0.
FileRise versions prior to 3.23.0 contain an improper authentication vulnerability where the software maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims without requiring email verification. This allows an attacker who can obtain provider-issued claims that collide with an existing local username to log in as that user, including the administrator, even if automatic provisioning is disabled. The vulnerability is fixed in version 3.23.0.
FileRise versions prior to 3.23.0 have an authentication flaw where failed TOTP verification attempts are tracked per session rather than account-wide. This allows an attacker with valid primary credentials to bypass the intended five-attempt limit for second-factor authentication by restarting login attempts in new sessions. The issue is resolved in version 3.23.0.
FileRise versions prior to 3.23.0 have an improper authentication vulnerability involving TOTP replay. The system validates a TOTP code within the accepted time window but does not prevent reuse of the same code for the same account during that window. An attacker with valid primary credentials and a captured TOTP code can replay the code in another login session before it expires. This vulnerability allows bypassing the intended one-time use of TOTP codes but does not disclose credentials or TOTP secrets. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.23.0 have a vulnerability that allows an authenticated attacker with a valid CSRF token to disable or enroll Time-based One-Time Password (TOTP) second factor authentication without recent full reauthentication. The enrollment endpoint prevents direct overwriting of an active TOTP secret but activates a newly generated secret before verifying possession. This flaw enables an attacker controlling an authenticated session to weaken or reset the second factor protection. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.23.0 contain an improper access control vulnerability in the /api/folder/renameFolder.php endpoint. Authenticated users who are not folder-scoped administrators can move a folder they own into another user's folder or the root namespace without proper authorization checks on the destination. This allows rekeying of ownership and ACLs to the new location. The vulnerability does not allow overwriting existing files and reveals limited information about destination paths through error messages. The issue is fixed in version 3.23.0.
FileRise versions prior to 3.21.0 have an authentication weakness where failed login attempts are tracked only by source IP and username combination. This allows an unauthenticated attacker to bypass intended rate limits by rotating usernames, enabling password spraying attacks from a single source beyond the expected limit. The issue is fixed in version 3.21.0.
FileRise versions prior to 3.21.0 have an improper authentication vulnerability where disabled login methods can still be used to authenticate via backend endpoints if valid credentials are known. This bypasses administrator login-method policies but does not allow credential-free access. The issue is fixed in version 3.21.0.
FileRise versions from 3.9.0 up to but not including 3.22.0 contain a vulnerability involving the use of a hard-coded legacy compatibility key. This key can be activated in pristine manual installations lacking a persistent tokens key, allowing attackers who obtain certain encrypted account or configuration files to decrypt TOTP secrets or credentials. Docker installations are not affected due to unique persistent keys. The issue is resolved in version 3.22.0.
FileRise versions prior to 3.21.0 have a cross-site scripting (XSS) vulnerability due to improper neutralization of input in the branding.footerHtml value exposed via an unauthenticated public site configuration API. Although the frontend sanitizes this value before rendering, the raw HTML is exposed through the API, which could be unsafe for alternate clients or future render paths. An administrator must first store a malicious footer value to exploit this issue. The vulnerability is fixed in version 3.21.0.
FileRise versions prior to 3.20.0 contain a vulnerability where the /api/file/snippet.php endpoint does not enforce an authenticated-session guard before processing short text preview requests. While the endpoint performs access control list (ACL) checks, unauthenticated requests can reach the ACL evaluation stage instead of being immediately rejected with a 401 response. Exploitation requires unusual proxy-header or ACL misconfiguration. This issue is fixed in version 3.20.0.
CVE-2026-62664 is a path traversal vulnerability in FileRise, a self-hosted web-based file manager. Versions prior to 3.19.0 do not properly reject dot-dot path segments in folder creation requests, allowing authenticated low-privileged users with appropriate permissions to create directories outside the intended upload directory. This can lead to unauthorized directory creation wherever the web server account has write access. The issue is fixed in FileRise version 3.19.0.
CVE-2026-61844 is a vulnerability in FileRise, a self-hosted web-based file manager, affecting versions prior to 3.18.0. The issue arises from how FileRise flattens logical folder paths into metadata filenames, causing distinct folders to share one metadata file. This allows a low-privileged user with control over one colliding folder and read_own access to another folder to manipulate metadata, potentially gaining unauthorized read and edit access to files. The vulnerability is fixed in version 3.18.0.
FileRise versions prior to 3.18.0 contain a missing authorization vulnerability that allows unauthenticated users with a valid share token and any configured share password to overwrite existing files by uploading a file with the same name. This flaw also affects authenticated uploads where users lack edit permissions, enabling silent replacement of file content without changing the original uploader metadata. The issue is resolved in version 3.18.0.
FileRise versions prior to 3.16.0 have an insufficient session expiration vulnerability where the isAdmin flag is stored in remember-me tokens and not updated upon user role changes. This allows a user with a pre-demotion token to retain administrator privileges after their role has been downgraded. The issue is fixed in version 3.16.0.
FileRise versions prior to 3.16.0 have a vulnerability where the application treats an empty or missing users.txt file as a fresh installation, allowing an unauthenticated remote attacker to create a new initial administrator account. This occurs because the application lacks a durable setup-complete marker independent of the user store. The issue is fixed in version 3.16.0.
FileRise versions prior to 3.16.0 have a vulnerability in their WebDAV Basic authentication implementation where the second factor of authentication (TOTP) is not enforced. This allows an attacker with valid primary credentials to bypass two-factor authentication and access WebDAV file permissions. The browser login path correctly enforces TOTP, but the WebDAV authentication callback does not. This issue is fixed in version 3.16.0.
FileRise versions prior to 3.16.0 contain a vulnerability where archive extraction does not properly enforce upload filename restrictions before writing files to disk. An authenticated user with upload and extract permissions can upload a ZIP archive containing files with blocked extensions, such as PHP scripts, which are then extracted and saved despite normal upload restrictions. This can lead to unauthorized code execution if the deployment executes uploaded content. The issue is fixed in version 3.16.0.