FileRise's snippet–retrieval endpoint permits an authenticated user with only read‑own access to a folder to fetch content from files uploaded by other users in the same folder. This represents a server‑side authorization deficiency that allows an attacker to read confidential data belonging to other users, compromising data confidentiality and privacy.

Affected versions of the FileRise file manager range from 2.3.7 through 3.10.0. The vulnerability is present in all builds within that span and is resolved in version 3.11.0. The product is distributed by error311.

The CVSS base score of 4.3 indicates moderate severity, and an EPSS score of less than 1% suggests low exploitation probability. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalogue. Exploitation requires an authenticated user with read‑own permissions on a shared folder and physical or network access to the FileRise instance. With these conditions, an attacker can exfiltrate sensitive file snippets from peer users.