FileRise, a self-hosted web file manager, allows a visitor with a share token or password to upload a file that shares a name with an existing file, silently replacing the original content while preserving its metadata. This flaw permits an attacker to tamper with stored data without needing full authentication, potentially injecting malicious content or corrupting critical files. The same vulnerability extends to authenticated uploads where a user lacks edit authority over the target file, broadening the exploitation surface.

FileRise is affected by versions older than 3.18.0. The flaw exists in upload-enabled shared-folder links and upload-only links that do not reject duplicate filenames. No specific sub‑components are enumerated beyond the general upload path /api/upload/upload.php.

The CVSS score of 8.2 indicates a high severity misuse. The EPSS score is unavailable, but the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by sending an HTTP POST containing the same filename to a shared slug or via the public upload API, leveraging a share token or password. The impact focuses on data integrity, with no direct confidentiality or availability implications enumerated.