CVE-2026-61843: FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated visitor can exploit it if they have a valid upload-enabled shared-folder or upload-only link token and, where configured, the share password. Authenticated users can also overwrite files through /api/upload/upload.php, including upload-only users who do not have edit authority over the existing file.
Are ordinary uploads affected, or only public sharing links?
Both are affected before version 3.18.0. The replacement gap applies to upload-enabled shared-folder links, upload-only links, and ordinary authenticated uploads through /api/upload/upload.php.
What conditions are required for a file to be overwritten?
The attacker must be able to upload to the relevant destination and submit a file using the same filename as an existing file. The existing file's content is silently replaced, while its original uploader metadata remains.
What version fixes the issue?
FileRise version 3.18.0 fixes the issue.