PT-2025-42793 · Filerise · Filerise

Published 2025-10-20 · Updated 2025-12-04 · CVE-2025-62510

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 1.5.0

Description FileRise is a self-hosted web-based file manager offering multi-file upload, editing, and batch operations. A regression in version 1.4.0 permitted the inference of folder visibility and ownership based on folder names. This allowed low-privilege users to view or interact with folders matching their username and, in certain instances, access content belonging to other users. The issue was addressed in version 1.5.0 by implementing explicit per-folder Access Control Lists (ACLs) – defining owners, read, write, share, and read own permissions – and enforcing strict server-side checks across various paths including list, read, write, share, rename, copy/move, zip, and WebDAV.

Recommendations Upgrade to FileRise version 1.5.0 or later.

Exploit

Fix

LPE

Improper Access Control

Weakness Enumeration

CWE-284

CWE-280

Related Identifiers

CVE-2025-62510

GHSA-JM96-2W52-5QJJ

Affected Products

Filerise

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62510.json · Exploit
• https://github.com/error311/FileRise/commit/b6d86b78967baa2f5a1e191903fc4df13998d87f · Patch
• https://github.com/error311/FileRise/security/advisories/GHSA-jm96-2w52-5qjj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62510 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62510 · Vendor Advisory
• https://github.com/error311/FileRise/issues/55 · Note
• https://t.me/cveNotify/144775 · Telegram Post
• https://twitter.com/CVEnew/status/1980331212590715008 · Twitter Post
• https://twitter.com/CveTodo/status/1980340833032282271 · Twitter Post
• https://t.me/CVEtracker/35336 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1980398844186628136 · Twitter Post