CVE-2026-54414 Details
Description
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).
A path traversal vulnerability has been identified in FileRise versions prior to 3.16.0, specifically in the shared-folder upload endpoint. This vulnerability allows for arbitrary file writing and unauthorized takeover of administrator accounts. The issue arises because the upload filename is inadequately validated, permitting URL-encoded path traversal sequences to bypass restrictions. Exploitation requires a valid, non-expired shared-folder upload link or token.
Users can upgrade to FileRise version 3.16.0 or later, which addresses the vulnerability by improving filename validation to reject encoded path separators before the upload is processed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise | TuranSec | ProductVendor |
| https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023 | TuranSec | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.16.0 | TuranSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | TuranSec |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| error311/FileRise | < 3.16.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | TuranSec |