# error311 FileRise.

Every CVE that names error311 FileRise among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root](https://agentprime.io/advisories/CVE-2026-104109.md)
  `CVE-2026-104109` · CVE record: error311 FileRise · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs](https://agentprime.io/advisories/CVE-2026-104107.md)
  `CVE-2026-104107` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php](https://agentprime.io/advisories/CVE-2026-104110.md)
  `CVE-2026-104110` · CVE record: error311 FileRise · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [FileRise OIDC login can bind an attacker identity to an existing local account](https://agentprime.io/advisories/CVE-2026-104108.md)
  `CVE-2026-104108` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-345
- [FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts](https://agentprime.io/advisories/CVE-2026-103977.md)
  `CVE-2026-103977` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-841
- [FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)](https://agentprime.io/advisories/CVE-2026-104105.md)
  `CVE-2026-104105` · CVE record: error311 FileRise · CVSS 6.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification](https://agentprime.io/advisories/CVE-2026-104106.md)
  `CVE-2026-104106` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, CWE-620
- [FileRise renameFolder omits destination-parent authorization](https://agentprime.io/advisories/CVE-2026-103988.md)
  `CVE-2026-103988` · CVE record: error311 FileRise · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying](https://agentprime.io/advisories/CVE-2026-69193.md)
  `CVE-2026-69193` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: Login Method Restriction Bypass via Direct API Access](https://agentprime.io/advisories/CVE-2026-69191.md)
  `CVE-2026-69191` · CVE record: error311 FileRise · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: Insecure default cryptographic key fallback in manual installs](https://agentprime.io/advisories/CVE-2026-77427.md)
  `CVE-2026-77427` · CVE record: error311 FileRise · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Hard-coded credentials, CWE-1188
- [FileRise: Unsanitized footerHtml in Public Site Config](https://agentprime.io/advisories/CVE-2026-69194.md)
  `CVE-2026-69194` · CVE record: error311 FileRise · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Cross-site scripting (XSS)
- [FileRise: Missing Authentication Guard on File Snippet Preview Endpoint](https://agentprime.io/advisories/CVE-2026-64856.md)
  `CVE-2026-64856` · CVE record: error311 FileRise · CVSS 3.7 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root](https://agentprime.io/advisories/CVE-2026-62664.md)
  `CVE-2026-62664` · CVE record: error311 FileRise · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation](https://agentprime.io/advisories/CVE-2026-61844.md)
  `CVE-2026-61844` · CVE record: error311 FileRise · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-706
- [FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares](https://agentprime.io/advisories/CVE-2026-61843.md)
  `CVE-2026-61843` · CVE record: error311 FileRise · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [FileRise: Remember-me auto-login uses stale admin role from token instead of current role](https://agentprime.io/advisories/CVE-2026-57493.md)
  `CVE-2026-57493` · CVE record: error311 FileRise · CVSS 6.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation](https://agentprime.io/advisories/CVE-2026-57492.md)
  `CVE-2026-57492` · CVE record: error311 FileRise · CVSS 7.4 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise: WebDAV authentication bypasses TOTP/MFA entirely](https://agentprime.io/advisories/CVE-2026-57490.md)
  `CVE-2026-57490` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-308
- [FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist](https://agentprime.io/advisories/CVE-2026-57491.md)
  `CVE-2026-57491` · CVE record: error311 FileRise · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Unrestricted file upload
- [FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass](https://agentprime.io/advisories/CVE-2026-57489.md)
  `CVE-2026-57489` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass
- [FileRise Shared Folder Symlink Escape](https://agentprime.io/advisories/CVE-2026-55498.md)
  `CVE-2026-55498` · CVE record: error311 FileRise · CVSS 4.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Path traversal
- [FileRise: Missing CSRF enforcement for file creation and share-link creation](https://agentprime.io/advisories/CVE-2026-54459.md)
  `CVE-2026-54459` · CVE record: error311 FileRise · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF)
- [FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance](https://agentprime.io/advisories/CVE-2026-92616.md)
  `CVE-2026-92616` · CVE record: error311 FileRise · CVSS 7.6 High · Not analysed yet · Published 16 Sept 2026 · Tags: Authentication bypass
- [FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover](https://agentprime.io/advisories/CVE-2026-54414.md)
  `CVE-2026-54414` · CVE record: error311 FileRise · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jun 2026 · Tags: Path traversal, Unrestricted file upload
- [FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret](https://agentprime.io/advisories/CVE-2026-44460.md)
  `CVE-2026-44460` · CVE record: error311 FileRise · CVSS 7.4 High · Not analysed yet · Published 27 May 2026 · Tags: Information disclosure, Authentication bypass
- [FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content](https://agentprime.io/advisories/CVE-2026-33477.md)
  `CVE-2026-33477` · CVE record: error311 FileRise · CVSS 4.3 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: Broken access control
- [FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback](https://agentprime.io/advisories/CVE-2026-33330.md)
  `CVE-2026-33330` · CVE record: error311 FileRise · CVSS 7.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: Broken access control
- [FileRise: Path Traversal in \`resumableIdentifier\` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle](https://agentprime.io/advisories/CVE-2026-33329.md)
  `CVE-2026-33329` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: Path traversal
- [FileRise: Default Encryption Key Enables Token Forgery and Config Decryption](https://agentprime.io/advisories/CVE-2026-33072.md)
  `CVE-2026-33072` · CVE record: error311 FileRise · CVSS 8.2 High · Not analysed yet · Published 20 Mar 2026 · Tags: Hard-coded credentials, CWE-1188
- [FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads](https://agentprime.io/advisories/CVE-2026-33071.md)
  `CVE-2026-33071` · CVE record: error311 FileRise · CVSS 4.3 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Unrestricted file upload, Information disclosure
- [FileRise has Unauthenticated Share Link Deletion](https://agentprime.io/advisories/CVE-2026-33070.md)
  `CVE-2026-33070` · CVE record: error311 FileRise · CVSS 3.7 Low · Not analysed yet · Published 20 Mar 2026 · Tags: Authentication bypass
- [FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control](https://agentprime.io/advisories/CVE-2026-25231.md)
  `CVE-2026-25231` · CVE record: error311 FileRise · CVSS 7.5 High · Not analysed yet · Published 9 Feb 2026 · Tags: Broken access control, Information disclosure
- [FileRise affected by HTML Injection using color property in file tags](https://agentprime.io/advisories/CVE-2026-25230.md)
  `CVE-2026-25230` · CVE record: error311 FileRise · CVSS 4.6 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Cross-site scripting (XSS), CWE-116
- [FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling](https://agentprime.io/advisories/CVE-2025-68116.md)
  `CVE-2025-68116` · CVE record: error311 FileRise · CVSS 8.9 High · Not analysed yet · Published 16 Dec 2025 · Tags: Cross-site scripting (XSS)
- [FileRise Vulnerable to Stored XSS via SVG Upload](https://agentprime.io/advisories/CVE-2025-66403.md)
  `CVE-2025-66403` · CVE record: error311 FileRise · CVSS 4.6 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: Cross-site scripting (XSS)
- [FileRise insecure folder visibility via name-based mapping and incomplete ACL checks](https://agentprime.io/advisories/CVE-2025-62510.md)
  `CVE-2025-62510` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2025 · Tags: Broken access control, CWE-280
- [FileRise improper ownership/permission validation allowed cross-tenant file operations](https://agentprime.io/advisories/CVE-2025-62509.md)
  `CVE-2025-62509` · CVE record: error311 FileRise · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2025 · Tags: Broken access control, CWE-280

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=error311-filerise>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/error311-filerise/>. Everything for agents: <https://agentprime.io/llms.txt>.