CVE-2026-62664: FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOADDIR wherever the web-server account can write. This issue is fixed in version 3.19.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.19.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged FileRise user can exploit it if they have a valid CSRF token and either create or owner permission on the selected parent folder.
What access does exploitation provide?
The attacker can create directories outside the configured UPLOAD_DIR, limited to locations where the web-server account has write permission. The issue does not describe reading files, modifying existing files, or executing code.
Which deployments are affected?
FileRise versions before 3.19.0 are affected. Exploitation requires that the attacker can reach the folder-creation API and has the required authenticated folder permissions.
How can I mitigate the issue if I cannot upgrade immediately?
Limit low-privileged users' create and owner permissions, particularly on folders they can use as traversal starting points. Restrict write permissions for the web-server account so it cannot create directories outside the intended upload area.