CVE-2026-33071: FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml, .php5, .htaccess, and other server-side executable types, bypassing the filename validation enforced by the regular upload path. In non-default deployments lacking Apache's LocationMatch protection, this leads to remote code execution. When files are uploaded via WebDAV, the createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php accept the filename directly from the WebDAV client without any validation. In contrast, the regular upload endpoint in UploadModel::upload() validates filenames against REGEXFILENAME. This issue is fixed in version 3.8.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33071?
CVE-2026-33071 is considered a high-severity vulnerability due to its potential for arbitrary file upload, which may lead to remote code execution.
How do I fix CVE-2026-33071?
To fix CVE-2026-33071, upgrade FileRise to version 3.8.0 or later, where the vulnerability has been addressed.
What are the risks associated with CVE-2026-33071?
The risks associated with CVE-2026-33071 include unauthorized file uploads, which could enable attackers to execute malicious scripts or access sensitive data.
In which versions of FileRise does CVE-2026-33071 exist?
CVE-2026-33071 affects all versions of FileRise prior to 3.8.0.
What type of attacks can CVE-2026-33071 facilitate?
CVE-2026-33071 can facilitate attacks such as remote code execution and web shell deployment through unauthorized file uploads.