CVE-2026-33070: FileRise has Unauthenticated Share Link Deletion
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33070?
CVE-2026-33070 is considered a critical vulnerability due to its potential to allow unauthorized deletion of file share links.
How do I fix CVE-2026-33070?
To fix CVE-2026-33070, upgrade FileRise to version 3.8.0 or later.
What impact does CVE-2026-33070 have on FileRise users?
CVE-2026-33070 allows unauthenticated users to delete any file share link, risking data availability and security.
Which versions of FileRise are affected by CVE-2026-33070?
FileRise versions prior to 3.8.0 are affected by CVE-2026-33070.
Is authentication required to exploit CVE-2026-33070?
No, CVE-2026-33070 can be exploited by any unauthenticated user.