CVE-2025-62510: FileRise insecure folder visibility via name-based mapping and incomplete ACL checks

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-20 · updated 2026-10-08
Weakness: CWE-280

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their username and, in some cases, other users’ content. This issue has been patched in version 1.5.0, where it introduces explicit per-folder ACLs (owners/read/write/share/read_own) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.

Affected products

error311 FileRise: before 1.5.0 — fixed in 1.5.0

How to fix

Upgrade to a fixed version: error311 FileRise 1.5.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-62510 or the next vulnerability affects your stack