PT-2025-48574 · Filerise · Filerise

Published 2025-12-01 · Updated 2026-01-07 · CVE-2025-66403

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 2.2.3

Description FileRise is a self-hosted web-based file manager. A stored cross-site scripting (XSS) issue exists due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads without sanitizing or restricting embedded script content. When a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is rendered in the browser when viewed within the application. SVGs are XML-based and allow scripting, executing in the origin context of the application, enabling full stored XSS.

Recommendations Update to version 2.2.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66403

GHSA-QRCV-VJVF-FR29

Affected Products

Filerise

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66403.json · Exploit
• 🔥 https://github.com/error311/FileRise/security/advisories/GHSA-qrcv-vjvf-fr29 · Exploit
• https://github.com/error311/FileRise/commit/f2ce43f18f0444f8f63f7c33758d1837dd5ba91e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66403 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66403 · Vendor Advisory
• https://t.me/cveNotify/144476 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1995658264248213775 · Twitter Post
• https://twitter.com/CVEnew/status/1995626929903329406 · Twitter Post
• https://t.me/CVEtracker/38607 · Telegram Post
• https://t.me/cveNotify/147977 · Telegram Post