CVE-2026-54459 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.
A vulnerability exists in FileRise, a self-hosted web-based file manager, in versions prior to 3.14.0. The issue arises because the application fails to properly enforce server-side Cross-Site Request Forgery (CSRF) token validation on authenticated file creation and share-link creation requests. While the frontend includes the CSRF token in the headers for these actions, the corresponding backend controllers do not validate the token before processing the requests. This oversight allows for the creation of empty files or share links with the permissions of the logged-in user, potentially leading to unauthorized file management actions.
Users can update to FileRise version 3.14.0 or later, where this vulnerability has been fixed by adding the necessary CSRF token checks to the affected endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851 | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| error311/FileRise | <= 3.13.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |