PT-2026-27491 · Onlyoffice+1 · Onlyoffice+1

Bg0D-Glitch · Publicado 2026-03-24 · Atualizado 2026-03-24 · CVE-2026-33330

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.10.0

Description FileRise is a self-hosted web file manager and WebDAV server. A flaw in the access control mechanism within FileRise’s ONLYOFFICE integration permits an authenticated user with read-only permissions to acquire a signed save callbackUrl for a file. Subsequently, this allows the attacker to manipulate the ONLYOFFICE save callback and overwrite the file with content they control. The affected component is the ONLYOFFICE integration. The vulnerable parameter is the callbackUrl.

Recommendations Update to version 3.10.0 or later.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-33330

GHSA-6C3J-F4X4-36M3

Produtos afetados

Filerise

Onlyoffice

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33330.json · Exploit
• https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c · Correção
• https://github.com/error311/FileRise/security/advisories/GHSA-6c3j-f4x4-36m3 · Aviso do Fabricante
• https://github.com/error311/FileRise/releases/tag/v3.10.0 · Nota
• https://osv.dev/vulnerability/CVE-2026-33330 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33330 · Nota de Segurança