FileRise allows a non-administrator user who owns a folder to rename that folder to any parent folder that does not belong to the user or to the root namespace. The rename operation reassigns ownership and access control entries to the new location, effectively granting the user access to files that were originally protected. This does not overwrite existing files, but it does allow the attacker to move entire directory trees into another user’s space or into the top-level namespace, bypassing normal authorization checks that would normally prevent such cross-user moves. The vulnerability therefore enables unauthorized modification of file ownership and access rights, which can lead to confidential data exposure and unauthorized data manipulation.

FileRise, a self-hosted web-based file manager, is affected in all releases prior to version 3.23.0. Any installation using these earlier versions can experience the described privilege escalation through the /api/folder/renameFolder.php endpoint.

The CVSS score of 5.4 indicates a medium severity vulnerability. The EPSS score is not available, and the issue is not currently listed in the CISA KEV catalog, suggesting that large-scale exploitation has not yet been observed. Attackers only need an authenticated account and a valid CSRF token; the operation can be performed through normal API traffic. Because the impact is limited to the application layer and does not involve arbitrary code execution or data loss outside the FileRise instance, the risk is moderate but still significant for organizations that rely on strict isolation of user data.