CVE-2026-64856 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.
A vulnerability exists in FileRise versions prior to 3.20.0, where the snippet preview endpoint (/api/file/snippet.php) lacks a proper authentication guard. This oversight allows unauthenticated requests to bypass the authentication layer and reach Access Control List (ACL) evaluations, although normal installations do not expose an unauthenticated arbitrary file read. The issue could potentially increase exposure in misconfigured deployments. The vulnerability has been patched in version 3.20.0.
Users can upgrade to FileRise version 3.20.0 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the FileRise GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/commit/8c0875bf8f7fd5c6769f4159b999bf08a9d4f0c9 | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.20.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-p4c7-8jm2-m88q | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| error311/FileRise | <= 3.19.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |