The flaw allows an authenticated non‑administrator to craft folder paths containing dot and dot‑dot segments that are processed before ACL checks. This enables the creation of files outside the intended folder and, if backend write credentials are present, even outside the configured WebDAV root. The local storage layer also creates directories before final containment validation and uses a prefix comparison that mistakenly accepts similarly named sibling roots, further widening the attack surface. Consequently, the vulnerability leads to disclosure or modification of data beyond the user’s intended scope.

This issue affects the FileRise self‑hosted web‑based file manager. All releases up to and including version 3.22.0 are vulnerable. The defect was addressed in FileRise version 3.23.0.

With a CVSS score of 6.5 the vulnerability is considered moderate. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitation requires that the user be authenticated with a non‑administrator role, possess a valid CSRF token, and have inherited edit permission on an ancestor folder. Under those conditions an attacker can traverse the directory hierarchy and write files beyond the intended location; when the backend supports write operations, the attacker could even create files outside the configured WebDAV root. This makes the risk significant for organizations that grant inherited edit rights to non‑admin users.