PT-2026-27491 · Onlyoffice+1 · Onlyoffice+1

Bg0D-Glitch · Published 2026-03-24 · Updated 2026-03-24 · CVE-2026-33330

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.10.0

Description FileRise is a self-hosted web file manager and WebDAV server. A flaw in the access control mechanism within FileRise’s ONLYOFFICE integration permits an authenticated user with read-only permissions to acquire a signed save callbackUrl for a file. Subsequently, this allows the attacker to manipulate the ONLYOFFICE save callback and overwrite the file with content they control. The affected component is the ONLYOFFICE integration. The vulnerable parameter is the callbackUrl.

Recommendations Update to version 3.10.0 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33330

GHSA-6C3J-F4X4-36M3

Affected Products

Filerise

Onlyoffice

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33330.json · Exploit
• https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c · Patch
• https://github.com/error311/FileRise/security/advisories/GHSA-6c3j-f4x4-36m3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33330 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33330 · Security Note
• https://github.com/error311/FileRise/releases/tag/v3.10.0 · Note