CVE-2026-33329: FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle
FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33329?
CVE-2026-33329 is classified as a critical severity vulnerability due to its potential for arbitrary file writes and recursive directory deletions.
How do I fix CVE-2026-33329?
To fix CVE-2026-33329, update FileRise to version 3.10.0 or later as it contains the necessary security patches.
What is affected by CVE-2026-33329?
CVE-2026-33329 affects FileRise versions from 1.0.1 up to but not including 3.10.0.
What kind of attacks can CVE-2026-33329 lead to?
CVE-2026-33329 can lead to arbitrary file write operations, which may allow an attacker to manipulate files on the server.
Is CVE-2026-33329 a widespread vulnerability?
The impact of CVE-2026-33329 is dependent on the deployment of affected FileRise versions, which may limit its widespread effect.