CVE-2026-33477: FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint /api/file/snippet.php allows an authenticated user with only readown access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the readown enforcement for hover previews. Version 3.11.0 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33477?
The severity of CVE-2026-33477 is currently assessed as high due to incorrect authorization allowing unauthorized access to sensitive file content.
How do I fix CVE-2026-33477?
To fix CVE-2026-33477, upgrade FileRise to version 3.11.0 or later where this vulnerability has been patched.
Who is affected by CVE-2026-33477?
Users of FileRise versions between 2.3.7 and 3.10.0 are affected by CVE-2026-33477 due to the flawed authorization mechanism.
What is the nature of CVE-2026-33477?
CVE-2026-33477 is an authorization vulnerability that enables read_own users to access other users' file contents through the snippet API endpoint.
Can CVE-2026-33477 lead to data breaches?
Yes, CVE-2026-33477 can potentially lead to data breaches as it allows unauthorized access to sensitive files belonging to other users.