PT-2026-7134 · Filerise · Filerise

Bytetyson · Published 2026-02-09 · Updated 2026-02-19 · CVE-2026-25231

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.3.0

Description FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0 have an unauthenticated file read issue because of missing access control on the /uploads directory. Files uploaded to this directory can be directly accessed by anyone who knows or guesses the file path, without authentication. This could lead to sensitive data exposure and privacy breaches.

Recommendations Update to version 3.3.0 or later.

Exploit

Fix

Improper Access Control

Files Accessible to External Parties

Weakness Enumeration

CWE-284

CWE-552

Related Identifiers

CVE-2026-25231

GHSA-HV99-77CW-HVPR

Affected Products

Filerise

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25231.json · Exploit
• https://github.com/error311/FileRise/security/advisories/GHSA-hv99-77cw-hvpr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25231 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25231 · Vendor Advisory
• https://github.com/error311/FileRise/releases/tag/v3.3.0 · Note
• https://twitter.com/CVEnew/status/2020959705846153618 · Twitter Post
• https://t.me/cveNotify/152502 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2020999264571191700 · Twitter Post