CVE-2026-104109 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a symlink to a directory outside the storage root, an authenticated non-administrator with extract permission who can upload or otherwise place an attacker-controlled ZIP in that folder can place an ordinary archive entry beneath the link. ZipArchive::extractTo() can then overwrite an external file, and post-extraction cleanup can delete that target through the same linked parent, only where the FileRise process has the required filesystem write or removal permission. The advisory does not establish that the attacker can create the prerequisite symlink through FileRise. This issue is fixed in version 3.23.0.
A vulnerability in FileRise, a self-hosted web-based file manager, allows an authenticated non-administrator user with extract permission to overwrite external files by exploiting the archive extraction process. Prior to version 3.23.0, FileRise validated archive entry names but extracted them directly into the authorized destination without proper path resolution. If the destination contained a symlink to a directory outside the storage root, the user could place a ZIP file under the link, causing 'ZipArchive::extractTo()' to follow the symlink and overwrite an external file. The subsequent cleanup process could delete the target through the linked parent, but only if the FileRise process had the necessary filesystem permissions.
Users are advised to upgrade to FileRise version 3.23.0, where this vulnerability has been fixed. The extraction process now occurs in a private temporary workspace, eliminating the risk of following symlinks to external directories. Additionally, the update includes various security enhancements and requires no data migration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-jp22-hh6w-mpwp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.23.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-jp22-hh6w-mpwp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| error311/FileRise | <= 3.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |