PT-2026-26588 · Filerise · Filerise

N0Rv-Tvt · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33071

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.8.0

Description FileRise is a self-hosted web file manager and WebDAV server. Prior to version 3.8.0, the WebDAV upload endpoint accepts any file extension, including .phtml, .php5, .htaccess, and other server-side executable types. This bypasses the filename validation enforced by the regular upload path. In deployments without Apache’s LocationMatch protection, this can lead to remote code execution. The createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php accept filenames directly from the WebDAV client without validation, unlike the regular upload endpoint which uses REGEX FILE NAME for validation.

Recommendations Versions prior to 3.8.0 should be updated to version 3.8.0 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Files Accessible to External Parties

Weakness Enumeration

CWE-434

CWE-552

Related Identifiers

CVE-2026-33071

GHSA-46GV-GF5F-WVR2

Affected Products

Filerise

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33071.json · Exploit
• https://github.com/error311/FileRise/security/advisories/GHSA-46gv-gf5f-wvr2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33071 · Security Note
• https://github.com/error311/FileRise/releases/tag/v3.8.0 · Note
• https://twitter.com/CVEnew/status/2035627006532927672 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035018195858334075 · Twitter Post