What’s Vulnerable › Products

error311 FileRise vulnerabilities

38 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 38 published in the last 12 months.

Check whether your error311 FileRise version is affected

Latest error311 FileRise vulnerabilities

• CVE-2026-77427 — FileRise: Insecure default cryptographic key fallback in manual installs (CVSS 5.9)
• CVE-2026-69194 — FileRise: Unsanitized footerHtml in Public Site Config (CVSS 4.8)
• CVE-2026-69193 — FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying (CVSS 6.5)
• CVE-2026-69191 — FileRise: Login Method Restriction Bypass via Direct API Access (CVSS 5.4)
• CVE-2026-64856 — FileRise: Missing Authentication Guard on File Snippet Preview Endpoint (CVSS 3.7)
• CVE-2026-62664 — FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root (CVSS 5.4)
• CVE-2026-61844 — FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation (CVSS 7.1)
• CVE-2026-61843 — FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares (CVSS 8.2)
• CVE-2026-57493 — FileRise: Remember-me auto-login uses stale admin role from token instead of current role (CVSS 6.8)
• CVE-2026-57492 — FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation (CVSS 7.4)
• CVE-2026-57491 — FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist (CVSS 6.5)
• CVE-2026-57490 — FileRise: WebDAV authentication bypasses TOTP/MFA entirely (CVSS 8.1)
• CVE-2026-57489 — FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass (CVSS 8.1)
• CVE-2026-104110 — FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php (CVSS 5.3)
• CVE-2026-104108 — FileRise OIDC login can bind an attacker identity to an existing local account (CVSS 8.1)
• CVE-2026-104107 — FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs (CVSS 6.5)
• CVE-2026-104106 — FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification (CVSS 6.5)
• CVE-2026-104105 — FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay) (CVSS 6.4)
• CVE-2026-103988 — FileRise renameFolder omits destination-parent authorization (CVSS 5.4)
• CVE-2026-103977 — FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts (CVSS 8.1)
• CVE-2026-104109 — FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root (CVSS 6.8)
• CVE-2026-55498 — FileRise Shared Folder Symlink Escape (CVSS 4.8)
• CVE-2026-54459 — FileRise: Missing CSRF enforcement for file creation and share-link creation (CVSS 4.3)
• CVE-2026-92616 — FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance (CVSS 6.8)
• CVE-2026-54414 — FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover (CVSS 9.8)