CVE-2026-62664

CVE-2026-62664 · FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.

CVSS 5.4 · Media · EPSS 0,3%

Publicación

2026-10-14T20:24:50.163Z

Actualización

2026-10-15T15:04:59.848Z

Comprueba tu servidor →