Advisories · Technology
error311 FileRise.
Every CVE that names error311 FileRise among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.8 Medium
FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root
- error311 FileRise
- Path traversal
- CVSS 6.5 Medium
FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs
- error311 FileRise
- Path traversal
- CVSS 5.3 Medium
FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
- error311 FileRise
- Information disclosure
- Authentication bypass
- CVSS 8.1 High
FileRise OIDC login can bind an attacker identity to an existing local account
- error311 FileRise
- Authentication bypass
- CWE-345
- CVSS 8.1 High
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
- error311 FileRise
- Authentication bypass
- CWE-841
- CVSS 6.4 Medium
FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
- error311 FileRise
- Authentication bypass
- CVSS 6.5 Medium
FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
- error311 FileRise
- Authentication bypass
- CWE-620
- CVSS 5.4 Medium
FileRise renameFolder omits destination-parent authorization
- error311 FileRise
- Broken access control
- CVSS 6.5 Medium
FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
- error311 FileRise
- Authentication bypass
- CVSS 5.4 Medium
FileRise: Login Method Restriction Bypass via Direct API Access
- error311 FileRise
- Authentication bypass
- CVSS 5.9 Medium
FileRise: Insecure default cryptographic key fallback in manual installs
- error311 FileRise
- Hard-coded credentials
- CWE-1188
- CVSS 4.8 Medium
FileRise: Unsanitized footerHtml in Public Site Config
- error311 FileRise
- Cross-site scripting (XSS)
- CVSS 3.7 Low
FileRise: Missing Authentication Guard on File Snippet Preview Endpoint
- error311 FileRise
- Information disclosure
- Authentication bypass
- CVSS 5.4 Medium
FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
- error311 FileRise
- Path traversal
- CVSS 7.1 High
FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
- error311 FileRise
- CWE-706
- CVSS 8.2 High
FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
- error311 FileRise
- Broken access control
- CVSS 6.8 Medium
FileRise: Remember-me auto-login uses stale admin role from token instead of current role
- error311 FileRise
- Authentication bypass
- CVSS 7.4 High
FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
- error311 FileRise
- Authentication bypass
- CVSS 8.1 High
FileRise: WebDAV authentication bypasses TOTP/MFA entirely
- error311 FileRise
- CWE-308
- CVSS 6.5 Medium
FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist
- error311 FileRise
- Unrestricted file upload
- CVSS 8.1 High
FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
- error311 FileRise
- Authentication bypass
- CVSS 4.8 Medium
FileRise Shared Folder Symlink Escape
- error311 FileRise
- Path traversal
- CVSS 4.3 Medium
FileRise: Missing CSRF enforcement for file creation and share-link creation
- error311 FileRise
- Cross-site request forgery (CSRF)
- CVSS 7.6 High
FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
- error311 FileRise
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
- error311 FileRise
- Path traversal
- Unrestricted file upload
- CVSS 7.4 High
FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret
- error311 FileRise
- Information disclosure
- Authentication bypass
- CVSS 4.3 Medium
FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content
- error311 FileRise
- Broken access control
- CVSS 7.1 High
FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback
- error311 FileRise
- Broken access control
- CVSS 8.1 High
FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle
- error311 FileRise
- Path traversal
- CVSS 8.2 High
FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
- error311 FileRise
- Hard-coded credentials
- CWE-1188
- CVSS 4.3 Medium
FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
- error311 FileRise
- Unrestricted file upload
- Information disclosure
- CVSS 3.7 Low
FileRise has Unauthenticated Share Link Deletion
- error311 FileRise
- Authentication bypass
- CVSS 7.5 High
FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
- error311 FileRise
- Broken access control
- Information disclosure
- CVSS 4.6 Medium
FileRise affected by HTML Injection using color property in file tags
- error311 FileRise
- Cross-site scripting (XSS)
- CWE-116
- CVSS 8.9 High
FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling
- error311 FileRise
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
FileRise Vulnerable to Stored XSS via SVG Upload
- error311 FileRise
- Cross-site scripting (XSS)
- CVSS 8.1 High
FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
- error311 FileRise
- Broken access control
- CWE-280
- CVSS 8.1 High
FileRise improper ownership/permission validation allowed cross-tenant file operations
- error311 FileRise
- Broken access control
- CWE-280