CVE-2026-54459

Deferred Deferred - Pending Action

CSRF in FileRise File Manager Prior to 3.14.0

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-54459

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.14.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

FileRise before version 3.14.0 has a vulnerability where POST endpoints for file creation and share-link creation do not enforce CSRF token checks. This allows attackers to create empty files or share links using a victim's session without proper validation.

Detection Guidance

Detecting this vulnerability requires checking if FileRise versions prior to 3.14.0 are running and if the affected endpoints lack CSRF token validation. Inspect HTTP requests to /api/file/createFile.php and /api/file/createShareLink.php for missing or invalid X-CSRF-Token headers during state-changing operations.

Impact Analysis

An attacker could trick a logged-in user into visiting a malicious site, leading to unauthorized file creation or share links under the user's account. This could result in data leakage or unauthorized access to files.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's access controls. Compliance may be compromised if sensitive data is exposed.

Mitigation Strategies

Upgrade FileRise to version 3.14.0 or later to address the missing CSRF token checks. If immediate upgrade is not possible, restrict access to the vulnerable endpoints via network-level controls or disable file creation/share link features until patched.

Hi! I’m here to help you understand CVE-2026-54459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70