CVE-2026-61843

HIGH 8.2

FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.

CWE	CWE-862
Vendor	error311
Product	filerise
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for error311 filerise

Be the first to know when new high vulnerabilities affecting error311 filerise are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Affected Versions

error311 / FileRise

< 3.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/error311/FileRise/security/advisories/GHSA-r787-5hp3-4874 github.com: https://github.com/error311/FileRise/commit/9ed1a38f00918849dbda30f54291d1451ed80d11 github.com: https://github.com/error311/FileRise/releases/tag/v3.18.0