CVE-2025-62509High· 8.1▾ TwilightFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRise’s file/folder handling allows low-privilege users to perform unauthorized o…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRise’s file/folder handling allows low-privilege users to perform unauthorized operations (view/delete/modify) on files created by other users. The root cause was inferring ownership/visibility from folder names (e.g., a folder named after a username) and missing server-side authorization/ownership checks across file operation endpoints. This amounted to an IDOR pattern: an attacker could operate on resources identified only by predictable names. This issue has been patched in version 1.4.0 and further hardened in version 1.5.0. A workaround for this issue involves restricting non-admin users to read-only or disable delete/rename APIs server-side, avoid creating top-level folders named after other usernames, and adding server-side checks that verify ownership before delete/rename/move.
filerise < 1.4.0Upgrade past the affected range:
filerise 1.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-62510High· 8.1FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-103988Medium· 5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-77427Medium· 5.9FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-69191Medium· 5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-69193Medium· 6.5FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-69194Medium· 4.8FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations