PT-2026-27490 · Filerise · Filerise

Kq5Y · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33329

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FileRise versions 1.0.1 through 3.9.9

Description FileRise is a self-hosted web file manager and WebDAV server. The resumableIdentifier parameter within the Resumable.js chunked upload handler, specifically the UploadModel::handleUpload() function, is directly incorporated into filesystem paths without proper sanitization. An authenticated user possessing upload privileges can leverage this to write files to arbitrary directories on the server, delete directories, and determine the existence of files and directories. The issue is addressed in version 3.10.0.

Recommendations Update to version 3.10.0 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-73

CWE-22

Identificadores relacionados

CVE-2026-33329

GHSA-C2JM-4WP9-5VRH

Produtos afetados

Filerise

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33329.json · Exploit
• https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh · Aviso do Fabricante
• https://github.com/error311/FileRise/releases/tag/v3.10.0 · Nota
• https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c · Correção
• https://twitter.com/TheHackerWire/status/2036540782883250368 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33329 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33329 · Nota de Segurança