CVE-2026-104109: FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a symlink to a directory outside the storage root, an authenticated non-administrator with extract permission who can upload or otherwise place an attacker-controlled ZIP in that folder can place an ordinary archive entry beneath the link. ZipArchive::extractTo() can then overwrite an external file, and post-extraction cleanup can delete that target through the same linked parent, only where the FileRise process has the required filesystem write or removal permission. The advisory does not establish that the attacker can create the prerequisite symlink through FileRise. This issue is fixed in version 3.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments running versions before 3.23.0 are exposed only when an extraction destination already contains a symlink to a directory outside the storage root. The FileRise process must also have permission to write to or remove files at the symlink target.
What access and conditions does an attacker need?
The attacker needs an authenticated non-administrator account with extract permission and the ability to upload or otherwise place an attacker-controlled ZIP in the affected folder. They also need a pre-existing symlink in the extraction destination; the advisory does not establish that FileRise can be used to create that symlink.
What can happen if exploitation succeeds?
A ZIP entry placed beneath the symlink can cause ZipArchive::extractTo() to overwrite a file outside the storage root. Post-extraction cleanup can also delete the target through that linked parent, subject to the FileRise process filesystem permissions.
How can exposure be reduced before upgrading?
Restrict extract permission and prevent untrusted users from placing ZIP archives in folders selected for extraction. Review extraction destinations for symlinks that resolve outside the storage root, and remove or isolate such links where possible.
What version fixes the issue?
The issue is fixed in FileRise version 3.23.0.