CVE-2026-62664CWE-22path-traversal

CVE-2026-62664

Medium · published October 15, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-10-15T01:17Z
References (3)
https://github.com/error311/FileRise/commit/3bd5144b4bfdd03f059de18a4d106c235cf70685 · [email protected]https://github.com/error311/FileRise/releases/tag/v3.19.0 · [email protected]https://github.com/error311/FileRise/security/advisories/GHSA-p7vh-cjpm-rmrq · [email protected]
EPSS history
Timeline
  • 16 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 14 OCT 20:24Z
    FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
    cvelistv5
  • 14 OCT 20:24Z
    FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
    cvelistv5