The vulnerability resides in the way the WebDAV interface inherits session privileges from the main web application. A low‑privilege user who authenticates with valid Basic‑Auth credentials can also supply an active administrator PHPSESSID cookie, causing the WebDAV layer to accept elevated rights it should not grant. As a result, the attacker can read and modify files that are normally restricted to administrators, which may allow further system compromise.

Any deployment of FileRise versions earlier than 3.28.0, including the 3.27.x series and older releases from error311:FileRise.

With a CVSS score of 7.6 the vulnerability is considered high severity. The EPSS score of less than 1% indicates a low probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. However, because the exploit requires only that an attacker has a legitimate account and can obtain an admin session cookie—both relatively easy to acquire in many environments—the risk is non‑negligible for organizations that expose WebDAV to the internet. The attack vector is remote, via the web interface, and would be easiest in cases where the WebDAV user name/password pair is already known or can be guessed.