CVE-2026-103988

Deferred Deferred - Pending Action

FileRise Path Traversal Vulnerability in Folder Renaming

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A qualifying user who owns a source folder can move that tree beneath another user's existing folder or into the root namespace, and the operation rekeys the moved ownership and ACL records to the new path. The destination must be unused and existing victim files cannot be overwritten. Distinct pre-fix errors reveal whether a specifically guessed destination path exists, but disclose no directory listing or file contents. This issue is fixed in version 3.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-15

AI Q&A

2026-10-15

EPSS Evaluated

N/A

NVD

CVE-2026-103988

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.23.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

FileRise before 3.23.0 has an authorization flaw in /api/folder/renameFolder.php. An authenticated non-admin user with a valid CSRF token can move their folder to another user's existing folder or root namespace without proper authorization checks on the destination. Ownership and ACL records are updated to the new path, but existing files cannot be overwritten.

Detection Guidance

Check FileRise version for anything below 3.23.0. Monitor logs for unauthorized folder moves or ownership changes. Look for errors indicating guessed destination paths exist.

Impact Analysis

An attacker with limited access could elevate privileges by moving their files into restricted areas, disrupting file organization, or gaining unauthorized access to other users' data. The flaw allows unauthorized folder relocation without overwriting existing files.

Mitigation Strategies

Upgrade FileRise to version 3.23.0 or later immediately. Review folder permissions and ownership for unauthorized changes. Restrict non-administrator users to folder-scoped operations.

Hi! I’m here to help you understand CVE-2026-103988. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70