CVE-2026-62664

CVE-2026-62664 · FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.

CVSS 5.4 · Mittel · EPSS 0,3%

Veröffentlicht

2026-10-14T20:24:50.163Z

Aktualisiert

2026-10-15T15:04:59.848Z

Prüfen Sie Ihren Server →