CVE-2026-61844 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.
A vulnerability in FileRise prior to version 3.18.0 allows low-privileged users to manipulate folder metadata, leading to unauthorized access and modification of files. The issue arises because the application flattens logical folder paths into metadata filenames, causing collisions. Users can exploit this by controlling a colliding folder, knowing the target basename, and having read_own access to the victim's folder. This vulnerability is particularly concerning in environments where metadata is used for authorization decisions.
Users can update to FileRise version 3.18.0, which addresses the vulnerability by using collision-resistant folder metadata filenames and improving the handling of folder ownership and read_own checks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-qpm8-pgmq-wxmh | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/error311/FileRise/commit/9ed1a38f00918849dbda30f54291d1451ed80d11 | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.18.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-qpm8-pgmq-wxmh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileRise | 3.17.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |