FileRise performs archive extraction without verifying resolved paths until after all files are written. An authenticated user with extract permission can upload a crafted ZIP that contains entries placed beneath an existing symlink pointing outside the storage root. ZipArchive::extractTo then follows the link and overwrites a file outside the designated directory. After extraction, FileRise deletes extracted files. If the process has write or delete permissions on the target file, this results in deletion of that file. The vulnerability allows an attacker who can place a ZIP in the symlinked folder to delete arbitrary files that FileRise can access, leading to data loss and potential service disruption. This flaw is a directory traversal abuse (CWE‑59).

The affected product is FileRise, a self‑hosted web‑based file manager developed by error311. Versions prior to 3.23.0 are vulnerable. The advisory notes that the attacker cannot create the prerequisite symlink through FileRise, so the symlink must already exist in the file system.

The CVSS score of 6.8 indicates moderate severity. EPSS data is not available, so the exploitation probability is unknown. The vulnerability is not listed in CISA KEV. Likely attack vector is an authenticated non‑administrator with file extraction rights who can upload a malicious ZIP to a folder containing a pre‑existing symlink pointing outside the storage root. Once the ZIP is extracted, the application overwrites files outside its root, then deletes them during cleanup. The impact is limited to files the FileRise process can modify; consequently the risk is significant for critical data stored in the linked directory. Because the flaw requires a privileged role to upload files, operational risk remains moderate but the data‑loss potential warrants rapid mitigation.