CVE-2026-64856

LOW 3.7

FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.

CWE	CWE-200 CWE-306
Vendor	error311
Product	filerise
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for error311 filerise

Be the first to know when new low vulnerabilities affecting error311 filerise are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

error311 / FileRise

< 3.20.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/error311/FileRise/security/advisories/GHSA-p4c7-8jm2-m88q github.com: https://github.com/error311/FileRise/commit/8c0875bf8f7fd5c6769f4159b999bf08a9d4f0c9 github.com: https://github.com/error311/FileRise/releases/tag/v3.20.0