CVE-2026-55498: FileRise Shared Folder Symlink Escape
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared. The flaw occurs because the affected shared-folder paths resolve symlinks without enforcing the original shared folder as the real-path boundary. This issue is fixed in version 3.15.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.15.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated person who possesses a valid public shared-folder token can exploit it. Exploitation also requires that subfolder browsing is enabled for the shared link and that a symbolic link within the shared folder points to a sibling directory under the upload root.
What data can be exposed?
The attacker can access files outside the folder originally shared, provided they are reachable through the symbolic link to a sibling directory under the upload root. Access may be obtained through shared-folder listing, direct download, or ZIP creation.
Are default shared-folder configurations affected?
The issue affects public shared-folder links only when subfolder browsing is enabled. The provided information does not establish whether that option is enabled by default.
What should be done if immediate patching is not possible?
Disable subfolder browsing on public shared-folder links and remove or review symbolic links within shared folders, particularly links targeting sibling directories under the upload root. Restrict or revoke exposed share tokens where appropriate.
How can I determine whether an instance is affected?
FileRise versions prior to 3.15.0 are affected when a public shared folder has subfolder browsing enabled and contains a symbolic link that resolves to a sibling directory under the upload root. Version 3.15.0 contains the fix.