FileRise versions prior to 3.16.0 contain a path traversal flaw in the shared-folder upload endpoint. The filename is validated by basename() and a regex that allows URL-encoded sequences. Because percent-encoding is not normalized before validation, an attacker can supply a filename that, after decoding, includes directory traversal characters. The upload routine copies the file to the target path without containment checks, allowing an attacker to write arbitrary files outside the intended directory. Overwriting a file such as users/users.txt can create an administrator account, leading to unauthenticated administrator takeover.

FileRise prior to version 3.16.0 is affected. Versions 3.16.0 and later include additional filename validation that rejects percent-encoded traversal sequences, eliminating the flaw.

CVSS 9.3 indicates critical severity. EPSS 1% indicates low but non-zero probability of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires the ability to send a file to the shared-folder upload endpoint; the vulnerability does not require privileged authentication beyond normal upload capability. Successful exploitation allows arbitrary file writes, which can be used to overwrite system files and create an admin account, giving full control of the application.