A flaw in the FileRise web file manager allows any user, even without authentication, to read files stored in the /uploads directory simply by knowing or guessing the URL path. Because there is no access control on that directory, the attacker can expose sensitive documents and personal data, resulting in a breach of confidentiality and potential privacy violations.

The vulnerability affects all deployments of FileRise versions earlier than 3.3.0. Users running the self‑hosted web file manager or WebDAV server before this release are at risk.

The CVSS base score is 7.5, classifying the issue as high severity. An EPSS score lower than 1% indicates a very low probability of exploitation in the wild, and the flaw is not recorded in the CISA KEV catalog. An attacker can exploit the weakness by issuing a simple HTTP GET request to /uploads/<filename> without providing credentials, making the attack straightforward once the path is discovered or guessed.