FileRise, a self‑hosted web file manager, contains a CWE‑22 path traversal flaw that allows an authenticated, low‑privileged user to supply traversal segments in the folderName field to create directories outside the configured upload root. By submitting a crafted createFolder request with a valid CSRF token and sufficient parent permissions, the attacker can create folders anywhere the web‑server process can write. This can lead to accidental or malicious placement of files, potentially enabling further compromise if the attacker can place executable content such as a web shell.

The vulnerability exists in all FileRise releases prior to version 3.19.0. Users running these versions on any operating system where the web‑server account has writable access beyond the UPLOAD_DIR are at risk.

The CVSS score of 5.4 indicates moderate severity, but no EPSS value is published, so the current exploitation probability is unknown. The flaw is not listed in CISA’s KEV catalog. Exploitation requires authentication and a valid CSRF token, and the attacker must have create or owner rights on the target parent folder, making it a low‑to‑moderate risk scenario for seeded or compromised accounts.