{"id":"CVE-2026-54459","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the serve…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-352"],"published":"2026-10-12","updated":"2026-10-13","sourceUpdated":"2026-10-13T14:17:38.493","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54459","references":[{"url":"https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851","label":"security-advisories@github.com"},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","label":"security-advisories@github.com"},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00118,"epssPercentile":0.01727,"ingestedAt":"2026-10-12T23:07:25.637Z","vendor":"error311","product":"FileRise","affected":["FileRise < 3.14.0"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-13T13:44:47.178669Z"},"slug":"CVE-2026-54459","body":"## Overview\n\nFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":220876,"id":"CVE-2026-54459","ts":1792026894714,"field":"exploit_available","old":"false","new":"true"}]}