CVE-2025-68116: FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling
FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site Scripting (XSS) due to unsafe handling of browser-renderable user uploads when served through the sharing and download endpoints. An attacker who can get a crafted SVG (primary) or HTML (secondary) file stored in a FileRise instance can cause JavaScript execution when a victim opens a generated share link (and in some cases via the direct download endpoint). This impacts share links (/api/file/share.php) and direct file access / download path (/api/file/download.php), depending on browser/content-type behavior. Version 2.7.1 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68116?
CVE-2025-68116 has a medium severity rating due to the potential for Stored Cross-Site Scripting (XSS) vulnerabilities.
How do I fix CVE-2025-68116?
To mitigate CVE-2025-68116, upgrade to FileRise version 2.7.1 or later, which addresses the vulnerability.
What kind of attack can be executed using CVE-2025-68116?
An attacker can exploit CVE-2025-68116 to execute arbitrary JavaScript code in the context of a victim's browser session.
Which versions of FileRise are affected by CVE-2025-68116?
FileRise versions prior to 2.7.1 are affected by CVE-2025-68116.
Is user data at risk due to CVE-2025-68116?
Yes, user data may be at risk as attackers can leverage the XSS vulnerability to steal information or perform actions on behalf of the users.