CVE-2026-57491: FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename. Post-extraction metadata pruning does not remove the blocked file, so deployments that execute uploaded content may permit code execution. This issue is fixed in version 3.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Who is exposed to exploitation?
FileRise deployments before 3.16.0 are affected when users have both upload and archive-extraction permissions. The impact is greatest where files written to upload destinations can be executed by the server.
What does an attacker need to exploit this issue?
An attacker needs an authenticated account with permission to upload files and extract ZIP archives. They can include a file with an extension blocked by normal uploads, such as a PHP-family extension, inside a ZIP archive.
Are normal file-upload restrictions sufficient to prevent exploitation?
No. The vulnerable extraction path writes ZIP entries with ZipArchive::extractTo() without applying UploadNamePolicy::isAllowedForWrite(), so a blocked filename can be created through archive extraction even if direct upload rejects it.
How can I remediate the issue?
Upgrade FileRise to version 3.16.0, which fixes the archive-extraction validation gap. If upgrading is not immediately possible, restrict upload and ZIP-extraction permissions and ensure uploaded-file directories are not executable by the web server.
Does post-extraction cleanup remove the blocked file?
No. The available information states that post-extraction metadata pruning does not remove the blocked file after it has been written to disk.