Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.
Published: 2026-10-12
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized file or share link creation via CSRF
Action: Patch
AI Analysis

Impact

FileRise does not require a valid server‑side CSRF token for the POST endpoints that create files or share links. This flaw is a classic example of CWE‑352 (Cross‑Site Request Forgery), which allows an attacker who can force a victim to send a cookie‑authenticated request to create an empty file or an arbitrary share link with the victim’s permissions. The lack of CSRF enforcement means that authenticated users are able to perform these state‑changing operations without any additional verification, potentially leading to data modification or unintended data exposure.

Affected Systems

Self‑hosted instances of FileRise by error311, versions earlier than 3.14.0 are affected.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate impact. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack is likely to occur via a cross‑site POST that includes the victim’s session cookie; the default SameSite=Lax setting does not entirely prevent reachability but still allows the POST from an untrusted origin.

Generated by OpenCVE AI on October 13, 2026 at 01:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FileRise to version 3.14.0 or later to enable server‑side CSRF checks for file and share‑link creation.
  • If an immediate upgrade is not feasible, restrict access to the /api/file/createFile.php and /api/file/createShareLink.php endpoints from untrusted origins using web‑server configuration or firewall rules to block CSRF attempts.
  • Ensure the session cookie is set to SameSite=Strict and that a robust CSRF protection mechanism is enabled for all state‑changing endpoints.

Generated by OpenCVE AI on October 13, 2026 at 01:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 05:15:00 +0000

Type Values Removed Values Added
First Time appeared Error311
Error311 filerise
Vendors & Products Error311
Error311 filerise

Mon, 12 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
Description FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.
Title FileRise: Missing CSRF enforcement for file creation and share-link creation
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

Subscriptions

Error311 Filerise
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T13:45:09.011Z

Reserved: 2026-06-15T15:30:40.318Z

Link: CVE-2026-54459

cve-icon Vulnrichment

Updated: 2026-10-13T13:45:05.411Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T22:17:04.780

Modified: 2026-10-13T14:17:38.493

Link: CVE-2026-54459

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T05:00:11Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)