FileRise is a web‑based file manager that lets users upload and extract ZIP archives. The flaw occurs because the application fails to enforce the upload blocklist when extracting ZIP entries. An authenticated user with extract permission can embed files with a blocked extension, such as a PHP script, inside a ZIP and have them written to disk when the archive is extracted. If the server subsequently executes uploaded files, this can result in arbitrary code execution in the context of the FileRise process. The weakness is rooted in unchecked file‑name validation (CWE‑434).

All FileRise installations older than version 3.16.0 are affected, regardless of underlying operating system. The vulnerability applies as long as the ZIP extraction feature is enabled on the web‑based file manager.

The CVSS score of 6.5 denotes moderate severity. Exploitation requires an authenticated user with upload and extract rights, so an attacker must first obtain access to the web application. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nevertheless, the ability to write a blocked file extension to a writable directory that may be executed introduces a code‑execution risk in deployments that run uploaded content.