9.8
CRITICAL
CVSS 3.1
CVE-2026-54414
FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
Overview
Description
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).
Details
INFO
Published Date :
June 19, 2026, 6:17 a.m.
Last Modified :
Oct. 26, 2026, 11:10 a.m.
Remotely Exploit :
Yes !
Source :
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | ||||
| CVSS 4.0 | CRITICAL | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c | ||||
| CVSS 4.0 | CRITICAL | 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c |
Solution
Update FileRise to version 3.16.0 or later to fix path traversal and arbitrary file write vulnerabilities.
- Update FileRise to version 3.16.0 or later.
- Review and secure all shared-folder links and tokens.
- Remove any compromised or unnecessary shared-folder links.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-54414.
| URL | Resource |
|---|---|
| https://github.com/error311/FileRise | |
| https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023 | |
| https://github.com/error311/FileRise/releases/tag/v3.16.0 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-54414 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-54414
weaknesses.
CAPEC-64: Using Slashes and URL Encoding Combined to Bypass Validation Logic Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-76: Manipulating Web Input to File System Calls Manipulating Web Input to File System Calls
CAPEC-78: Using Escaped Slashes in Alternate Encoding Using Escaped Slashes in Alternate Encoding
CAPEC-79: Using Slashes in Alternate Encoding Using Slashes in Alternate Encoding
CAPEC-126: Path Traversal Path Traversal
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs Accessing Functionality Not Properly Constrained by ACLs
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-54414 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-54414 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 26, 2026
Action Type Old Value New Value Added Translation Title: FileRise de error311, Description: FileRise anterior a la versión 3.16.0 es vulnerable a salto de ruta en el endpoint de carga de carpetas compartidas (/API/folder/uploadToSharedFolder.PHP), lo que lleva a la escritura arbitraria de archivos y a la toma de control de la cuenta de administrador. El nombre de archivo de carga es validado por FolderController con basename() y REGEX_FILE_NAME, que permiten secuencias codificadas en URL (la expresión regular bloquea / y \ pero no %). El nombre de archivo sin procesar se pasa luego a UploadModel::handleUpload, donde se reconstruye como trim(urldecode(basename($fileName))), reintroduciendo separadores de ruta después de la validación (por ejemplo, ..%2fusers%2fusers.txt se convierte en .. / users/users.txt). UploadNamePolicy::isAllowedForWrite() aplica basename() internamente y por lo tanto solo evalúa el componente final (users.txt), permitiendo que la secuencia de salto de ruta pase la política de extensión. La ruta de destino se utiliza luego directamente en move_uploaded_file() sin una verificación de contención de realpath, permitiendo una escritura fuera del directorio de carga previsto. Un atacante que posee un enlace/token de carpeta compartida válido, no caducado y habilitado para carga (los cuales están diseñados para ser compartidos públicamente) puede sobrescribir users/users.txt para crear una cuenta de administrador, lo que resulta en una toma de control de administrador no autenticada y, dependiendo de la configuración, ejecución remota de código. La explotación requiere la posesión de un enlace/token de carpeta compartida válido, no caducado y habilitado para carga. Este problema se corrige en la versión 3.16.0, que decodifica la URL antes de la validación y rechaza cualquier separador de ruta en el nombre de archivo de carga. -
CVE Modified by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Aug. 10, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://github.com/error311/FileRise', 'vendor': 'error311', 'product': 'FileRise', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.16.0', 'versionType': 'semver'}], 'programFiles': ['src/FileRise/Domain/UploadModel.php', 'src/FileRise/Support/UploadNamePolicy.php', 'src/FileRise/Http/Controllers/FolderController.php'], 'collectionURL': 'https://github.com/error311/FileRise', 'defaultStatus': 'unaffected'}] [{'repo': 'https://github.com/error311/FileRise', 'vendor': 'error311', 'product': 'FileRise', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '3.16.0'}], 'programFiles': ['src/FileRise/Domain/UploadModel.php', 'src/FileRise/Support/UploadNamePolicy.php', 'src/FileRise/Http/Controllers/FolderController.php'], 'collectionURL': 'https://github.com/error311/FileRise', 'defaultStatus': 'unaffected'}] Changed Description FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename() and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %). The raw filename is then passed to UploadModel::handleUpload, where it is reconstructed as trim(urldecode(basename($fileName))), re-introducing path separators after validation (e.g. ..%2fusers%2fusers.txt becomes ../users/users.txt). UploadNamePolicy::isAllowedForWrite() applies basename() internally and therefore only evaluates the final component (users.txt), allowing the traversal sequence to pass the extension policy. The destination path is then used directly in move_uploaded_file() with no realpath containment check, allowing a write outside the intended upload directory. An attacker who possesses a valid, non-expired, upload-enabled shared-folder link/token (which are designed to be shared publicly) can overwrite users/users.txt to create an administrator account, resulting in unauthenticated admin takeover and, depending on configuration, remote code execution. Exploitation requires possession of a valid, non-expired, upload-enabled shared-folder link/token. This issue is fixed in 3.16.0, which URL-decodes before validation and rejects any path separators in the upload filename. FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %). -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 22, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-54414', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-06-22T15:04:58.077602Z'} -
New CVE Received by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Jun. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://github.com/error311/FileRise', 'vendor': 'error311', 'product': 'FileRise', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '3.16.0', 'versionType': 'semver'}], 'programFiles': ['src/FileRise/Domain/UploadModel.php', 'src/FileRise/Support/UploadNamePolicy.php', 'src/FileRise/Http/Controllers/FolderController.php'], 'collectionURL': 'https://github.com/error311/FileRise', 'defaultStatus': 'unaffected'}] Added Description FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename() and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %). The raw filename is then passed to UploadModel::handleUpload, where it is reconstructed as trim(urldecode(basename($fileName))), re-introducing path separators after validation (e.g. ..%2fusers%2fusers.txt becomes ../users/users.txt). UploadNamePolicy::isAllowedForWrite() applies basename() internally and therefore only evaluates the final component (users.txt), allowing the traversal sequence to pass the extension policy. The destination path is then used directly in move_uploaded_file() with no realpath containment check, allowing a write outside the intended upload directory. An attacker who possesses a valid, non-expired, upload-enabled shared-folder link/token (which are designed to be shared publicly) can overwrite users/users.txt to create an administrator account, resulting in unauthenticated admin takeover and, depending on configuration, remote code execution. Exploitation requires possession of a valid, non-expired, upload-enabled shared-folder link/token. This issue is fixed in 3.16.0, which URL-decodes before validation and rejects any path separators in the upload filename. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-22 Added CWE CWE-434 Added Reference https://github.com/error311/FileRise Added Reference https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023 Added Reference https://github.com/error311/FileRise/releases/tag/v3.16.0
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.