What’s Vulnerable › Vulnerabilities

CVE-2026-33329: FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-24 · updated 2026-06-17
• Weakness: CWE-22

Description

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.

Affected products

• error311 FileRise: from 1.0.1 before 3.10.0 — fixed in 3.10.0

How to fix

Upgrade to a fixed version: error311 FileRise 3.10.0. Check the vendor advisory for mitigations.

References

• https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c
• https://github.com/error311/FileRise/releases/tag/v3.10.0
• https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh

Get alerted when CVE-2026-33329 or the next vulnerability affects your stack