FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00114.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
error311 FileRise affected
Version Status Constraints
< 3.3.0 affected
—

Configuration 1 [-]

cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*

No data.

Vendor Product Confidence Versions
Error311 Filerise — —

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Subscriptions

Vendors Products
Error311 Subscribe
Filerise Subscribe
Filerise Subscribe
Filerise Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/error311/FileRise/releases/tag/v3.3.0 cve-icon cve-icon
https://github.com/error311/FileRise/security/advisories/GHSA-hv99-77cw-hvpr cve-icon cve-icon
History

Thu, 19 Feb 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Filerise
Filerise filerise
CPEs cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*
Vendors & Products Filerise
Filerise filerise

Tue, 10 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Error311
Error311 filerise
Vendors & Products Error311
Error311 filerise

Mon, 09 Feb 2026 19:30:00 +0000

Type Values Removed Values Added
Description FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.
Title FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
Weaknesses CWE-284
CWE-552
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-02-10T16:01:25.905Z

Reserved: 2026-01-30T14:44:47.328Z

Link: CVE-2026-25231

cve-icon Vulnrichment

Updated: 2026-02-10T15:39:56.020Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-09T20:15:56.863

Modified: 2026-02-19T19:31:59.170

Link: CVE-2026-25231

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-02-10T11:35:17Z

Weaknesses