CVE Feed

    Dashboard / CVE / CVE-2025-68116

    CVE-2025-68116

    FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site Scripting (XSS) due to unsafe handling of browser-renderable user uploads when served through the sharing and download endpoints. An attacker who can get a crafted SVG (primary) or HTML (secondary) file stored in a FileRise instance can cause JavaScript execution when a victim opens a generated share link (and in some cases via the direct download endpoint). This impacts share links (`/api/file/share.php`) and direct file access / download path (`/api/file/download.php`), depending on browser/content-type behavior. Version 2.7.1 fixes the issue.

    Published:Dec 16, 2025
    Last Modified:Jan 2, 2026
    EPS:Dec 16, 2025
    EPSS Score:0.00046
    CVSS Score:8.9

    Affected Products

    Vendor
    Filerise
    Product
    Filerise

    Exploits

    https://github.com/error311/FileRise/security/advisories/GHSA-35pp-ggh6-c59chttps://github.com/x0root/CVE-2025-68116

    Related CVEs

    CVE-2026-33477 (CVSS 4.3) — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In ver…
    CVE-2026-33330 (CVSS 7.1) — FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control i…
    CVE-2026-33329 (CVSS 8.1) — FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the r…
    CVE-2026-33072 (CVSS 8.2) — FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default en…
    CVE-2026-33071 (CVSS 4.3) — FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endp…
    CVE-2026-33070 (CVSS 3.7) — FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authenticati…
    CVE-2026-25231 (CVSS 7.5) — FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains …
    CVE-2026-25230 (CVSS 4.6) — FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability al…
    CVE-2025-66403 (CVSS 4.6) — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior …
    CVE-2025-62510 (CVSS 8.1) — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In ver…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High