FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.
References
| Link | Resource |
|---|---|
| https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c | Patch |
| https://github.com/error311/FileRise/releases/tag/v3.10.0 | Product Release Notes |
| https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh | Exploit Mitigation Vendor Advisory |
Configurations
History
26 Mar 2026, 11:59
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Filerise
Filerise filerise |
|
| CPE | cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:* | |
| References | () https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c - Patch | |
| References | () https://github.com/error311/FileRise/releases/tag/v3.10.0 - Product, Release Notes | |
| References | () https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh - Exploit, Mitigation, Vendor Advisory |
24 Mar 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-24 20:16
Updated : 2026-03-26 11:59
NVD link : CVE-2026-33329
Mitre link : CVE-2026-33329
CVE.ORG link : CVE-2026-33329
JSON object : View
Products Affected
filerise
- filerise