CVE-2026-54459: FileRise: Missing CSRF enforcement for file creation and share-link creation
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.14.0
Event History
Frequently Asked Questions
Which deployments are affected?
FileRise versions before 3.14.0 are affected. The exposed operations are file creation and share-link creation through /api/file/createFile.php and /api/file/createShareLink.php.
What must an attacker be able to do to exploit this?
An attacker must cause a request to be issued using a logged-in FileRise user's session. No authentication or CSRF token is required in the crafted request itself, but user interaction is required.
Does the default session-cookie configuration reduce exposure?
Yes. The default SameSite=Lax session cookie reduces the reachability of ordinary cross-site POST requests, but the affected handlers still do not validate a server-side X-CSRF-Token header.
What can an attacker do through the affected endpoints?
A successful request can create an empty file or create a share link with the logged-in user's permissions. The available impact therefore depends on the permissions of the targeted user session.
How should this be remediated?
Upgrade FileRise to version 3.14.0, which fixes the issue.