CVE-2026-104109

Deferred Deferred - Pending Action

Symlink Path Traversal in FileRise File Manager

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a symlink to a directory outside the storage root, an authenticated non-administrator with extract permission who can upload or otherwise place an attacker-controlled ZIP in that folder can place an ordinary archive entry beneath the link. ZipArchive::extractTo() can then overwrite an external file, and post-extraction cleanup can delete that target through the same linked parent, only where the FileRise process has the required filesystem write or removal permission. The advisory does not establish that the attacker can create the prerequisite symlink through FileRise. This issue is fixed in version 3.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104109

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.23.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

FileRise before 3.23.0 has a path traversal flaw in its archive extraction. It validates entry names but extracts files directly into the live destination before checking resolved paths. If the destination contains a symlink pointing outside the storage root, an authenticated non-admin with extract permissions can place a malicious ZIP file. The ZipArchive::extractTo() function may then overwrite external files, and cleanup could delete those targets through the same symlink if the process has sufficient filesystem permissions.

Detection Guidance

Detecting this vulnerability requires checking for symlinks in the FileRise storage directory and verifying if the FileRise version is below 3.23.0. Inspect the FileRise installation directory for symlinks pointing outside the storage root using commands like 'ls -la' or 'find'. Ensure the FileRise version is updated to 3.23.0 or later to mitigate the risk.

Impact Analysis

An attacker with extract permissions could overwrite critical system files or delete important data outside the FileRise storage root. This may lead to denial of service, data loss, or system compromise if the FileRise process has high filesystem permissions. The impact depends on the permissions of the FileRise service account.

Compliance Impact

This vulnerability could lead to unauthorized file modification or deletion, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. Unauthorized overwrites of sensitive files may result in compliance breaches depending on the affected data and system configuration.

Mitigation Strategies

Update FileRise to version 3.23.0 or later to address the path validation issue in archive extraction.

Hi! I’m here to help you understand CVE-2026-104109. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70