CVE-2026-61844
7.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-706
Impact
Authenticated low-privileged users can hijack ownership of files in colliding folders to read and modify them. They need an existing account with read_own/edit_own permissions, knowledge of the target filename, and control over a path that produces a metadata name collision.
Root cause
Folder paths are flattened into metadata filenames by replacing separators and spaces with hyphens, causing different directories like 'team/docs' and 'team-docs' to overwrite and share the same metadata file.
Affected systems
FileRise prior to 3.18.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L
Fix & remediation
Upgrade FileRise to version 3.18.0 or later. No interim mitigation is documented, so patch immediately.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available. This issue is fixed in version 3.18.0.