CVE-2026-104107: FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. With an authenticated non-administrator session, a valid CSRF token, and inherited edit permission on a legitimate ancestor, the local filesystem or WebDAV adapter later resolves those segments as path navigation, permitting attacker-controlled file creation outside the authorized folder and, where backend credentials permit, outside the configured WebDAV root. Local storage also created directories before final containment validation and used a prefix comparison that accepted similarly named sibling roots. The source's tentative availability impact conflicts with the maintainer response and structured impact metadata, which state that no additional availability consequence was demonstrated; curator resolution is required. This issue is fixed in version 3.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-administrator user can exploit it if they have a valid CSRF token and inherited edit permission on a legitimate ancestor folder. The attack is network-accessible and does not require user interaction.
Are default installations affected?
The available data does not establish whether the vulnerable permission arrangement is present by default. Exploitation specifically depends on inherited edit permission being granted on an ancestor folder.
What can an attacker do after successful exploitation?
An attacker can create files outside their authorized folder by using dot and dot-dot path segments. With WebDAV backend credentials that permit it, file creation may extend outside the configured WebDAV root; local storage may also accept similarly named sibling roots because of a flawed prefix comparison.
What should be done if an immediate upgrade is not possible?
The data supports restricting non-administrator users' inherited edit permissions on ancestor folders and reviewing access to the affected save-file operation. Upgrade to FileRise 3.23.0 when possible, as it contains the fix.
How can administrators look for possible exploitation?
Review file-creation activity from non-administrator accounts for folder inputs containing dot or dot-dot segments, and inspect for unexpected files or directories outside authorized folders, configured storage roots, or the configured WebDAV root. Pay particular attention to similarly named sibling directories adjacent to the intended storage root.