What’s Vulnerable › Vulnerabilities

CVE-2026-54459: FileRise: Missing CSRF enforcement for file creation and share-link creation

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-13
• Weakness: CWE-352

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.

Affected products

• error311 FileRise: before 3.14.0

References

• https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851
• https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g
• https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g

Get alerted when CVE-2026-54459 or the next vulnerability affects your stack