Skip to content
Error311 Filerise vulnerabilities
-
error311 filerise
FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root
CVE-2026-104109
6.8 Medium
-
error311 filerise
FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs
CVE-2026-104107
6.5 Medium
-
error311 filerise
FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
CVE-2026-104110
Public exploit
5.3 Medium
-
error311 filerise
FileRise OIDC login can bind an attacker identity to an existing local account
CVE-2026-104108
8.1 High
-
error311 filerise
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
CVE-2026-103977
Public exploit
8.1 High
-
error311 filerise
FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
CVE-2026-104105
6.4 Medium
-
error311 filerise
FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
CVE-2026-104106
6.5 Medium
-
error311 filerise
FileRise renameFolder omits destination-parent authorization
CVE-2026-103988
5.4 Medium
-
error311 filerise
FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
CVE-2026-69193
6.5 Medium
-
error311 filerise
FileRise: Login Method Restriction Bypass via Direct API Access
CVE-2026-69191
5.4 Medium
-
error311 filerise
FileRise: Insecure default cryptographic key fallback in manual installs
CVE-2026-77427
5.9 Medium
-
error311 filerise
FileRise: Unsanitized footerHtml in Public Site Config
CVE-2026-69194
4.8 Medium
-
error311 filerise
FileRise: Missing Authentication Guard on File Snippet Preview Endpoint
CVE-2026-64856
3.7 Low
-
error311 filerise
FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
CVE-2026-62664
5.4 Medium
-
error311 filerise
FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
CVE-2026-61844
7.1 High
-
error311 filerise
FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
CVE-2026-61843
8.2 High
-
error311 filerise
FileRise: Remember-me auto-login uses stale admin role from token instead of current role
CVE-2026-57493
6.8 Medium
-
error311 filerise
FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
CVE-2026-57492
7.4 High
-
error311 filerise
FileRise: WebDAV authentication bypasses TOTP/MFA entirely
CVE-2026-57490
8.1 High
-
error311 filerise
FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist
CVE-2026-57491
6.5 Medium
-
error311 filerise
FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
CVE-2026-57489
8.1 High
-
error311 filerise
FileRise Shared Folder Symlink Escape
CVE-2026-55498
4.8 Medium
-
error311 filerise
FileRise: Missing CSRF enforcement for file creation and share-link creation
CVE-2026-54459
4.3 Medium
-
error311 filerise
FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
CVE-2026-92616
7.6 High
-
error311 filerise
FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
CVE-2026-54414
9.3 Critical
-
error311 filerise
FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret
CVE-2026-44460
7.4 High
-
error311 filerise
FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content
CVE-2026-33477
4.3 Medium
-
error311 filerise
FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback
CVE-2026-33330
7.1 High
-
error311 filerise
FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle
CVE-2026-33329
8.1 High
-
error311 filerise
FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
CVE-2026-33072
8.2 High
-
error311 filerise
FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
CVE-2026-33071
4.3 Medium
-
error311 filerise
FileRise has Unauthenticated Share Link Deletion
CVE-2026-33070
3.7 Low
-
error311 filerise
FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
CVE-2026-25231
7.5 High
-
error311 filerise
FileRise affected by HTML Injection using color property in file tags
CVE-2026-25230
4.6 Medium
-
error311 filerise
FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling
CVE-2025-68116
Public exploit
8.9 High
-
error311 filerise
FileRise Vulnerable to Stored XSS via SVG Upload
CVE-2025-66403
4.6 Medium
-
error311 filerise
FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
CVE-2025-62510
8.1 High
-
error311 filerise
FileRise improper ownership/permission validation allowed cross-tenant file operations
CVE-2025-62509
8.1 High