The flaw lies in the WebDAV upload endpoint of FileRise, which accepts filenames of any type without validating extensions. This bypasses the stricter checks used by the regular upload path, allowing attackers to upload server‑side executable files such as .phtml, .php5, or .htaccess. If such a file is executed by the web server, the attacker can run arbitrary code on the host, compromising confidentiality, integrity, or availability of the affected system. The weakness aligns with CWE-434 and CWE-552, reflecting unrestricted file upload and access control issues.

All FileRise installations running a version older than 3.8.0 are affected. The vulnerability specifically impacts the self‑hosted web file manager and its WebDAV server component. No other products or versions are listed as impacted by this advisory.

The vulnerability carries a score of 4.3, indicating moderate severity, and an estimated exploit probability of less than 1%, suggesting that widespread exploitation is unlikely. It is not included in CISA’s Known Exploited Vulnerabilities catalog. The attack can be performed remotely through the WebDAV upload interface; an authenticated or unauthenticated client that can send uploads may trigger the flaw. In deployments lacking Apache LocationMatch protection, a malicious file can be executed immediately, giving an attacker full control over the host. The issue was addressed in FileRise 3.8.0.