Read the docs
TI-2026-25513 Aliases CVE-2026-33071

FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads

Priority HIGH 71CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution, Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434 and CWE-552.

Summary

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml, .php5, .htaccess, and other server-side executable types, bypassing the filename validation enforced by the regular upload path. In non-default deployments lacking Apache's LocationMatch protection, this leads to remote code execution. When files are uploaded via WebDAV, the createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php accept the filename directly from the WebDAV client without any validation. In contrast, the regular upload endpoint in UploadModel::upload() validates filenames against REGEX_FILE_NAME. This issue is fixed in version 3.8.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00659 51st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed FileRise (error311): 3.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
error311FileRisebefore 3.8.03.8.0Patch availableCNA
  • FileRise Vendorerror311 Affected before 3.8.0 Fixed in 3.8.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*before 3.8.0Vulnerableerror311
  • cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:* Versions before 3.8.0 Vulnerable ·error311

Remediation

  • Fix · CNA FileRise (error311) Fixed in 3.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33071

References

Exploit 1

Other 1

  • TI-2026-25514 FileRise: Default Encryption Key Enables Token Forgery and Config Decryption CVSS 3.1HIGH 8.2
  • TI-2025-41705 FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling CVSS 3.1HIGH 8.9
  • TI-2026-25739 Path traversal in error311 FileRise CVSS 3.1HIGH 8.1
  • TI-2026-25740 FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback CVSS 3.1HIGH 7.1
  • TI-2026-25512 FileRise has Unauthenticated Share Link Deletion CVSS 3.1MEDIUM 4.8
  • TI-2026-25873 FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content CVSS 3.1MEDIUM 4.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences