PT-2025-51741 · Filerise · Filerise

Published 2025-12-16 · Updated 2026-01-02 · CVE-2025-68116

Positive Technologies (AI Summary)

CVSS v3.1

8.9

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 2.7.1

Description FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are susceptible to Stored Cross-Site Scripting (XSS) because of unsafe handling of browser-renderable user uploads when served through the sharing and download endpoints. An attacker who can upload a crafted SVG or HTML file to a FileRise instance can cause JavaScript execution when a victim opens a generated share link or, in some cases, via the direct download endpoint. The issue impacts share links at the /api/file/share.php endpoint and direct file access / download path at the /api/file/download.php endpoint.

Recommendations Update FileRise to version 2.7.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-68116

GHSA-35PP-GGH6-C59C

Affected Products

Filerise

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68116.json · Exploit
• 🔥 https://github.com/error311/FileRise/security/advisories/GHSA-35pp-ggh6-c59c · Exploit
• https://osv.dev/vulnerability/CVE-2025-68116 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68116 · Security Note
• https://twitter.com/CVEnew/status/2000986384493084923 · Twitter Post
• https://twitter.com/CveFindCom/status/2000984036504707525 · Twitter Post
• https://t.me/cveNotify/147545 · Telegram Post