CVE-2026-103988: FileRise renameFolder omits destination-parent authorization
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A qualifying user who owns a source folder can move that tree beneath another user's existing folder or into the root namespace, and the operation rekeys the moved ownership and ACL records to the new path. The destination must be unused and existing victim files cannot be overwritten. Distinct pre-fix errors reveal whether a specifically guessed destination path exists, but disclose no directory listing or file contents. This issue is fixed in version 3.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated non-administrator account that is not folder-scoped can exploit it if it has a valid CSRF token and owns a source folder. The user must be able to submit requests to the renameFolder endpoint.
What are the practical limitations on an attack?
The attacker can move a folder tree only to a destination parent that is unused; existing victim files cannot be overwritten. They can target another user's existing folder or the root namespace, and the moved tree's ownership and ACL records are rekeyed to its new path.
Are default deployments affected?
The provided information does not establish whether the vulnerable account permissions are enabled by default. Exposure depends on having a qualifying authenticated, non-folder-scoped user who owns a source folder.
Can this vulnerability reveal information before a successful move?
Yes. Pre-fix error differences reveal whether a specifically guessed destination path exists, but do not provide directory listings or file contents.
What version fixes the issue?
FileRise version 3.23.0 fixes this issue. Systems running versions prior to 3.23.0 are affected under the stated account and request conditions.