agentprime: error311-fileriseEvery new CVE for error311-filerise.https://agentprime.io/CVE-2026-104109: FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage roothttps://agentprime.io/advisories/CVE-2026-104109/https://agentprime.io/advisories/CVE-2026-104109/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:44:29 GMTCVECVE-2026-104107: FileRise: Authenticated path traversal escapes configured storage root through inherited ACLshttps://agentprime.io/advisories/CVE-2026-104107/https://agentprime.io/advisories/CVE-2026-104107/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:42:08 GMTCVECVE-2026-104110: FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.phphttps://agentprime.io/advisories/CVE-2026-104110/https://agentprime.io/advisories/CVE-2026-104110/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:40:15 GMTCVECVE-2026-104108: FileRise OIDC login can bind an attacker identity to an existing local accounthttps://agentprime.io/advisories/CVE-2026-104108/https://agentprime.io/advisories/CVE-2026-104108/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:39:27 GMTCVECVE-2026-103977: FileRise: Session-scoped TOTP rate limiting permits repeated verification attemptshttps://agentprime.io/advisories/CVE-2026-103977/https://agentprime.io/advisories/CVE-2026-103977/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:38:39 GMTCVECVE-2026-104105: FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)https://agentprime.io/advisories/CVE-2026-104105/https://agentprime.io/advisories/CVE-2026-104105/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:37:44 GMTCVECVE-2026-104106: FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verificationhttps://agentprime.io/advisories/CVE-2026-104106/https://agentprime.io/advisories/CVE-2026-104106/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:36:27 GMTCVECVE-2026-103988: FileRise renameFolder omits destination-parent authorizationhttps://agentprime.io/advisories/CVE-2026-103988/https://agentprime.io/advisories/CVE-2026-103988/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:35:46 GMTCVECVE-2026-69193: FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Sprayinghttps://agentprime.io/advisories/CVE-2026-69193/https://agentprime.io/advisories/CVE-2026-69193/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:34:13 GMTCVECVE-2026-69191: FileRise: Login Method Restriction Bypass via Direct API Accesshttps://agentprime.io/advisories/CVE-2026-69191/https://agentprime.io/advisories/CVE-2026-69191/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:33:33 GMTCVECVE-2026-77427: FileRise: Insecure default cryptographic key fallback in manual installshttps://agentprime.io/advisories/CVE-2026-77427/https://agentprime.io/advisories/CVE-2026-77427/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:32:55 GMTCVECVE-2026-69194: FileRise: Unsanitized footerHtml in Public Site Confighttps://agentprime.io/advisories/CVE-2026-69194/https://agentprime.io/advisories/CVE-2026-69194/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:32:01 GMTCVECVE-2026-64856: FileRise: Missing Authentication Guard on File Snippet Preview Endpointhttps://agentprime.io/advisories/CVE-2026-64856/https://agentprime.io/advisories/CVE-2026-64856/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:25:37 GMTCVECVE-2026-62664: FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload roothttps://agentprime.io/advisories/CVE-2026-62664/https://agentprime.io/advisories/CVE-2026-62664/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:24:50 GMTCVECVE-2026-61844: FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolationhttps://agentprime.io/advisories/CVE-2026-61844/https://agentprime.io/advisories/CVE-2026-61844/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:23:53 GMTCVECVE-2026-61843: FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shareshttps://agentprime.io/advisories/CVE-2026-61843/https://agentprime.io/advisories/CVE-2026-61843/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:22:57 GMTCVECVE-2026-57493: FileRise: Remember-me auto-login uses stale admin role from token instead of current rolehttps://agentprime.io/advisories/CVE-2026-57493/https://agentprime.io/advisories/CVE-2026-57493/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:22:06 GMTCVECVE-2026-57492: FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creationhttps://agentprime.io/advisories/CVE-2026-57492/https://agentprime.io/advisories/CVE-2026-57492/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:21:15 GMTCVECVE-2026-57490: FileRise: WebDAV authentication bypasses TOTP/MFA entirelyhttps://agentprime.io/advisories/CVE-2026-57490/https://agentprime.io/advisories/CVE-2026-57490/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:20:23 GMTCVECVE-2026-57491: FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklisthttps://agentprime.io/advisories/CVE-2026-57491/https://agentprime.io/advisories/CVE-2026-57491/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:17:04 GMTCVECVE-2026-57489: FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypasshttps://agentprime.io/advisories/CVE-2026-57489/https://agentprime.io/advisories/CVE-2026-57489/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 20:16:00 GMTCVECVE-2026-55498: FileRise Shared Folder Symlink Escapehttps://agentprime.io/advisories/CVE-2026-55498/https://agentprime.io/advisories/CVE-2026-55498/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 19:57:05 GMTCVECVE-2026-54459: FileRise: Missing CSRF enforcement for file creation and share-link creationhttps://agentprime.io/advisories/CVE-2026-54459/https://agentprime.io/advisories/CVE-2026-54459/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 21:55:15 GMTCVECVE-2026-92616: FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritancehttps://agentprime.io/advisories/CVE-2026-92616/https://agentprime.io/advisories/CVE-2026-92616/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 14:38:11 GMTCVECVE-2026-54414: FileRise shared-folder upload path traversal allows arbitrary file write and admin takeoverhttps://agentprime.io/advisories/CVE-2026-54414/https://agentprime.io/advisories/CVE-2026-54414/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 19 Jun 2026 05:41:44 GMTCVEcriticalCVE-2026-44460: FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secrethttps://agentprime.io/advisories/CVE-2026-44460/https://agentprime.io/advisories/CVE-2026-44460/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 27 May 2026 16:39:12 GMTCVECVE-2026-33477: FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file contenthttps://agentprime.io/advisories/CVE-2026-33477/https://agentprime.io/advisories/CVE-2026-33477/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 26 Mar 2026 17:09:00 GMTCVECVE-2026-33330: FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callbackhttps://agentprime.io/advisories/CVE-2026-33330/https://agentprime.io/advisories/CVE-2026-33330/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 19:15:03 GMTCVECVE-2026-33329: FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oraclehttps://agentprime.io/advisories/CVE-2026-33329/https://agentprime.io/advisories/CVE-2026-33329/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 24 Mar 2026 19:14:42 GMTCVECVE-2026-33072: FileRise: Default Encryption Key Enables Token Forgery and Config Decryptionhttps://agentprime.io/advisories/CVE-2026-33072/https://agentprime.io/advisories/CVE-2026-33072/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Mar 2026 08:31:08 GMTCVECVE-2026-33071: FileRise: WebDAV upload path bypasses filename validation enforced by regular uploadshttps://agentprime.io/advisories/CVE-2026-33071/https://agentprime.io/advisories/CVE-2026-33071/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Mar 2026 08:27:37 GMTCVECVE-2026-33070: FileRise has Unauthenticated Share Link Deletionhttps://agentprime.io/advisories/CVE-2026-33070/https://agentprime.io/advisories/CVE-2026-33070/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Mar 2026 08:25:07 GMTCVECVE-2026-25231: FileRise affected by an Unauthenticated File Read Due to Insufficient Access Controlhttps://agentprime.io/advisories/CVE-2026-25231/https://agentprime.io/advisories/CVE-2026-25231/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Feb 2026 18:34:36 GMTCVECVE-2026-25230: FileRise affected by HTML Injection using color property in file tagshttps://agentprime.io/advisories/CVE-2026-25230/https://agentprime.io/advisories/CVE-2026-25230/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Feb 2026 18:32:09 GMTCVECVE-2025-68116: FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handlinghttps://agentprime.io/advisories/CVE-2025-68116/https://agentprime.io/advisories/CVE-2025-68116/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 16 Dec 2025 16:43:30 GMTCVECVE-2025-66403: FileRise Vulnerable to Stored XSS via SVG Uploadhttps://agentprime.io/advisories/CVE-2025-66403/https://agentprime.io/advisories/CVE-2025-66403/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 01 Dec 2025 22:20:56 GMTCVECVE-2025-62510: FileRise insecure folder visibility via name-based mapping and incomplete ACL checkshttps://agentprime.io/advisories/CVE-2025-62510/https://agentprime.io/advisories/CVE-2025-62510/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Oct 2025 17:39:10 GMTCVECVE-2025-62509: FileRise improper ownership/permission validation allowed cross-tenant file operationshttps://agentprime.io/advisories/CVE-2025-62509/https://agentprime.io/advisories/CVE-2025-62509/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Oct 2025 17:38:49 GMTCVE