FileRise before version 3.16.0 contains a path traversal flaw in the shared‑folder upload endpoint. The filename is validated with basename() and a regex that ignores percent‑encoding, allowing an attacker to craft a URL‑encoded file name that, after decoding, contains directory traversal characters. The upload routines then reconstruct the filename and copy it to the destination with move_uploaded_file() without a containment check, permitting writes outside the intended directory. By overwriting a file such as users/users.txt an attacker can create an administrator account, leading to unauthenticated admin takeover and, depending on the system configuration, remote code execution.

The vulnerability exists in FileRise prior to version 3.16.0; the fix is delivered in release 3.16.0 and later. No specific sub‑versions are identified beyond that range, so any installation of 3.15 or earlier is affected.

The CVSS score of 9.3 indicates a high severity flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of a valid, non‑expired upload‑enabled shared‑folder link/token, which are intentionally shared publicly. With such a token an attacker can perform the path traversal and overwrite critical files, resulting in privilege escalation or potentially remote code execution. The attack surface is remote and relies on the web upload interface.