CVE-2026-61844

Deferred Deferred - Pending Action

FileRise Path Traversal Vulnerability Allows Metadata Manipulation

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-61844

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.18.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

FileRise before version 3.18.0 has a flaw where folder paths are converted into metadata filenames by replacing separators and spaces with hyphens. This allows different folders like team/docs and team-docs to share the same metadata file. An attacker with low privileges can exploit this by creating a colliding folder name, modifying metadata to claim ownership of files in another folder, and then reading or editing those files if they have the right permissions.

Detection Guidance

Detecting this vulnerability requires checking FileRise version and analyzing folder structures for potential path collisions. Verify if your FileRise instance is running version 3.18.0 or later. Inspect folder names that could collide when separators and spaces are replaced with hyphens (e.g., team/docs vs team-docs).

Commands to check version: curl -s http://<file-rise-url>/version or check the application's version file. Review folder structures for naming conflicts that could lead to metadata collisions.

Impact Analysis

If you use FileRise before version 3.18.0, an attacker with limited access could gain unauthorized access to your files by manipulating folder names and metadata. They could read sensitive files or modify them if they have edit permissions, potentially leading to data breaches or unauthorized changes.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. Unauthorized access to personal or health data may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately upgrade FileRise to version 3.18.0 or later to patch the vulnerability. Review and correct any folder structures that could cause path collisions by renaming folders to avoid separator/space replacements creating conflicts.

Restrict low-privileged user access to sensitive folders and audit existing permissions. Monitor metadata files for unauthorized modifications and ensure read_own and edit_own permissions are properly configured.

Hi! I’m here to help you understand CVE-2026-61844. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70