CVE-2026-33071 Details
Description
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml, .php5, .htaccess, and other server-side executable types, bypassing the filename validation enforced by the regular upload path. In non-default deployments lacking Apache's LocationMatch protection, this leads to remote code execution. When files are uploaded via WebDAV, the createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php accept the filename directly from the WebDAV client without any validation. In contrast, the regular upload endpoint in UploadModel::upload() validates filenames against REGEX_FILE_NAME. This issue is fixed in version 3.8.0.
A vulnerability in FileRise, a self-hosted web file manager and WebDAV server, allows for remote code execution in versions prior to 3.8.0. The issue arises because the WebDAV upload endpoint accepts any file extension, including those associated with server-side executable types, bypassing the filename validation required by the regular upload path. In non-default deployments without Apache's LocationMatch protection, this vulnerability can be exploited. The problem stems from the createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php, which accept filenames directly from the WebDAV client without validation. This vulnerability is fixed in version 3.8.0.
Users can update to FileRise version 3.8.0, which addresses this vulnerability by normalizing WebDAV write filenames, centralizing filename validation for uploads, and blocking dangerous file types such as .htaccess and executable extensions.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/releases/tag/v3.8.0 | [email protected] | ProductRelease Notes |
| https://github.com/error311/FileRise/security/advisories/GHSA-46gv-gf5f-wvr2 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | [email protected] |
| CWE-552 | Files or Directories Accessible to External Parties | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| filerise filerise | < 3.8.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |