CVE-2026-57491

Deferred Deferred - Pending Action

Path Traversal in FileRise Web File Manager

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename. Post-extraction metadata pruning does not remove the blocked file, so deployments that execute uploaded content may permit code execution. This issue is fixed in version 3.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-57491

EUVD

EUVD-2026-101635

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

FileRise before 3.16.0 allows authenticated users with upload and extract permissions to bypass filename restrictions during ZIP archive extraction. The system fails to check if extracted files are allowed before writing them to disk, potentially enabling malicious files like PHP scripts to be placed in the destination directory.

Detection Guidance

Check for unauthorized PHP or executable files in directories accessible by FileRise. Review uploaded ZIP archives for blocked extensions like .php, .phtml, or .phar. Inspect FileRise logs for extract operations that may have bypassed filename restrictions.

Impact Analysis

An attacker could upload a ZIP file containing a blocked file type (e.g., PHP) and extract it to a directory where the server executes uploaded content. This could lead to arbitrary code execution on the server, compromising the system or data.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially resulting in data breaches or loss of sensitive information. Such incidents may violate compliance requirements under GDPR, HIPAA, or other regulations, leading to legal penalties or reputational damage.

Mitigation Strategies

Upgrade FileRise to version 3.16.0 or later. Disable or restrict extract permissions for users until the update is applied. Monitor for unexpected file writes in web-accessible directories.

Hi! I’m here to help you understand CVE-2026-57491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70