CVE-2026-62664Medium· 5.4▾ SunlitFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::crea…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104107Medium· 6.5FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-77427Medium· 5.9FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-69191Medium· 5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-69193Medium· 6.5FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-69194Medium· 4.8FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-64856Low· 3.7FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations