CVE-2026-61844: FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize readown and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has readown access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.18.0
Event History
Frequently Asked Questions
Which deployments are exposed?
FileRise deployments running versions before 3.18.0 are exposed where logical folder names can collide after separators and spaces are converted to hyphens. The affected authorization paths are read_own and ownership-restricted editing.
What does an attacker need to exploit this?
The attacker needs low-privileged access, control of a folder whose flattened metadata filename collides with the target folder, knowledge of the target file basename, and read_own access to the target folder. Modifying the victim file additionally requires edit-own permission.
Does this affect all users by default?
Exploitation depends on FileRise using read_own or ownership-restricted edit permissions and on an attacker being able to create or control a colliding folder name. The provided information does not establish that every default deployment enables these conditions.
How can administrators check for exposure before patching?
Review folder names for pairs that become identical when path separators and spaces are replaced with hyphens, such as team/docs and team-docs. Prioritize collisions involving folders protected by read_own or ownership-restricted editing and files whose basenames may be known to other users.
What can be done if upgrading immediately is not possible?
Remove or rename colliding folder paths and avoid creating names that flatten to the same hyphenated form. Restrict low-privileged users' access to read_own-protected folders and ownership-restricted editing until FileRise can be updated to 3.18.0.