PT-2025-42792 · Filerise · Filerise

Published 2025-10-20 · Updated 2025-12-04 · CVE-2025-62509

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 1.4.0

Description FileRise is a self-hosted web-based file manager. A flaw in file/folder handling allows low-privilege users to perform unauthorized operations (view, delete, modify) on files created by other users. This is due to inferring ownership/visibility from folder names and missing server-side authorization checks. This issue represents an IDOR (Insecure Direct Object Reference) pattern, where an attacker can operate on resources identified by predictable names. The vulnerable operations occur through file operation endpoints.

Recommendations Update to version 1.4.0 or later. As a workaround, restrict non-admin users to read-only access. As a workaround, disable delete/rename APIs server-side. Avoid creating top-level folders named after other usernames. Add server-side checks to verify ownership before delete, rename, or move operations.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-280

Related Identifiers

CVE-2025-62509

GHSA-6P87-Q9RH-95WH

Affected Products

Filerise

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62509.json · Exploit
• https://github.com/error311/FileRise/commit/25ce6a76beb60950359c0304765ad91a8aff8ad8 · Patch
• https://github.com/error311/FileRise/security/advisories/GHSA-6p87-q9rh-95wh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62509 · Security Note
• https://github.com/error311/FileRise/issues/53 · Note
• https://t.me/cveNotify/144774 · Telegram Post
• https://t.me/CVEtracker/35335 · Telegram Post
• https://twitter.com/CVEnew/status/1980331215044461049 · Twitter Post
• https://twitter.com/CveTodo/status/1980340420228874323 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1980406522111807801 · Twitter Post