PT-2026-27490 · Filerise · Filerise

Kq5Y · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33329

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions FileRise versions 1.0.1 through 3.9.9

Description FileRise is a self-hosted web file manager and WebDAV server. The resumableIdentifier parameter within the Resumable.js chunked upload handler, specifically the UploadModel::handleUpload() function, is directly incorporated into filesystem paths without proper sanitization. An authenticated user possessing upload privileges can leverage this to write files to arbitrary directories on the server, delete directories, and determine the existence of files and directories. The issue is addressed in version 3.10.0.

Recommendations Update to version 3.10.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2026-33329

GHSA-C2JM-4WP9-5VRH

Affected Products

Filerise

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33329.json · Exploit
• https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh · Vendor Advisory
• https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c · Patch
• https://osv.dev/vulnerability/CVE-2026-33329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33329 · Security Note
• https://github.com/error311/FileRise/releases/tag/v3.10.0 · Note
• https://twitter.com/TheHackerWire/status/2036540782883250368 · Twitter Post