CVE-2026-54414

Summary

FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).

Affected Software

Weaknesses

• CWE-22: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://github.com/error311/FileRise/releases/tag/v3.16.0
• https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023
• https://github.com/error311/FileRise

• ←Previous
• Next→