CVE-2026-61843
8.2HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-862
Impact
Attackers can silently overwrite existing files while preserving the original uploader's metadata. They only need access to an upload-enabled share link with any configured password, or low-privilege authenticated upload access without edit permissions.
Root cause
The upload endpoints fail to reject incoming filenames that already exist in the target folder.
Affected systems
FileRise prior to version 3.18.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Fix & remediation
Upgrade FileRise to version 3.18.0 or later. If you cannot patch immediately, disable or revoke upload-enabled shared-folder and upload-only share links.
$ git pull && git checkout v3.18.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.