CVE-2026-33329

HIGH EPSS 35.5%
Published Mar 24, 20263mo ago · Modified Jun 17, 20261w ago
8.1 CVSS 3.1
High
Find Similar
Published Mar 24, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago

Description

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.

CVSS Details

Base Score
8.1
Exploitability
2.8
Impact
5.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
35.5% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-22 Path Traversal Resource Mgmt
CWE-73

Affected Products 1

VendorProductVersionRange
filerisefilerise*≥1.0.1  –  <3.10.0

References 3

  • github.com https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c
    Patch
  • github.com https://github.com/error311/FileRise/releases/tag/v3.10.0
    ProductRelease Notes
  • github.com https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh
    ExploitMitigationVendor Advisory

Remediation

  • github.com https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c
    Patch