CVE-2025-62510: FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their username and, in some cases, other users’ content. This issue has been patched in version 1.5.0, where it introduces explicit per-folder ACLs (owners/read/write/share/readown) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62510?
CVE-2025-62510 is classified as a low-severity vulnerability.
How do I fix CVE-2025-62510?
To mitigate CVE-2025-62510, upgrade to FileRise version 1.5.0 or later.
What software is affected by CVE-2025-62510?
CVE-2025-62510 affects FileRise versions prior to 1.5.0.
What is the nature of the vulnerability in CVE-2025-62510?
CVE-2025-62510 allows low-privilege users to infer folder visibility and ownership from folder names.
When was CVE-2025-62510 reported?
CVE-2025-62510 was disclosed alongside the release of version 1.4.0 of FileRise.