CVE-2026-33329

Katalog CVE

CVSS 8.1 · High EPSS 0,61%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada filerise. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.

Rincian

Terbit di NVD

24 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh exploit · mitigasi · advisory vendor
• https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c patch
• https://github.com/error311/FileRise/releases/tag/v3.10.0 product · release notes