CVE-2026-64856

Deferred Deferred - Pending Action

Unauthenticated ACL Bypass in FileRise File Manager

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64856

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.20.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

FileRise before version 3.20.0 has a vulnerability in /api/file/snippet.php where it does not enforce standard authenticated-session checks for short text preview requests. While ACL checks are still performed, unauthenticated requests bypass the immediate 401 response and reach ACL evaluation. Only unusual proxy-header or ACL misconfigurations allow further processing of file paths and content.

Detection Guidance

Check FileRise version for anything below 3.20.0. Inspect server logs for unauthorized access attempts to /api/file/snippet.php. Look for unusual proxy-header configurations or ACL misconfigurations that might allow unauthenticated requests to bypass standard session checks.

Impact Analysis

This vulnerability could allow unauthenticated users to trigger ACL checks and potentially access file previews or content if additional misconfigurations exist. Normal installations are not exposed to unauthenticated arbitrary file reads due to ACL checks, but the issue increases attack surface by bypassing initial authentication.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it requires unusual proxy-header or ACL misconfiguration to allow unauthorized access. The endpoint still enforces FileRise ACL checks, limiting exposure. However, if misconfigured, it could potentially lead to unauthorized file access, which may violate data protection principles under GDPR or HIPAA depending on the data involved.

Mitigation Strategies

Upgrade FileRise to version 3.20.0 or later immediately. Review and correct any proxy-header or ACL misconfigurations. Monitor logs for suspicious activity targeting /api/file/snippet.php.

Hi! I’m here to help you understand CVE-2026-64856. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70