CVE Feed

    Dashboard / CVE / CVE-2026-33329

    CVE-2026-33329

    FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.

    Published:Mar 24, 2026
    Last Modified:Mar 27, 2026
    EPS:Mar 24, 2026
    EPSS Score:0.00067
    CVSS Score:8.1

    Affected Products

    Vendor
    Error311
    Product
    Filerise
    Vendor
    Filerise
    Product
    Filerise

    Exploits

    https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh

    Related CVEs

    CVE-2026-54414 (CVSS 9.3) — FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploa…
    CVE-2026-44460 (CVSS 7.4) — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior …
    CVE-2026-33477 (CVSS 4.3) — FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In ver…
    CVE-2026-33330 (CVSS 7.1) — FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control i…
    CVE-2026-33072 (CVSS 8.2) — FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default en…
    CVE-2026-33071 (CVSS 4.3) — FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endp…
    CVE-2026-33070 (CVSS 3.7) — FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authenticati…
    CVE-2026-25231 (CVSS 7.5) — FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains …
    CVE-2026-25230 (CVSS 4.6) — FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability al…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High