FileRise exposes a broken access control flaw in its ONLYOFFICE integration that allows an authenticated user with read‑only permissions to retrieve a signed save callback URL for any file the user can view. An attacker can then forge this callback and force the server to overwrite the target file with content controlled by the attacker. This results in a loss of integrity for the affected file and could enable further compromise if the overwritten content references or embeds malicious payloads. The vulnerability is exemplified by CWE‑863, which indicates missing or inadequate access checks during critical operations.

The vulnerability affects the FileRise self‑hosted web file manager and WebDAV server. All releases prior to version 3.10.0 are vulnerable. Only the versions after the 3.10.0 release have applied the patch that eliminates the flaw.

The CVSS score of 7.1 classifies the issue as high severity, but the EPSS value of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack scenario requires the attacker to be logged in with read‑only privileges and to manipulate a signed callback URL, so the presumed attack vector is authenticated remote exploitation. Even with the low EPSS, the potential for file corruption or further lateral movement warrants prompt attention.