CVE-2026-54459
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-352
Impact
Attackers can trick an authenticated user into creating empty files or generating share links under their account permissions. To exploit this, the attacker needs network access and a logged-in user to trigger a cross-site request.
Root cause
The file creation and share-link creation API endpoints fail to validate the X-CSRF-Token header on incoming POST requests.
Affected systems
FileRise versions prior to 3.14.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Fix & remediation
Upgrade FileRise to version 3.14.0 or later. No interim configuration mitigation is specified.
$ git pull && git checkout v3.14.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.