CVE-2026-25231

Katalog CVE

CVSS 7.5 · High EPSS 1,7%

Kerentanan Improper Access Control pada filerise. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.

Rincian

Terbit di NVD

9 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/error311/FileRise/security/advisories/GHSA-hv99-77cw-hvpr exploit · advisory vendor
• https://github.com/error311/FileRise/releases/tag/v3.3.0 release notes