CVE-2026-103988
MEDIUM 5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A qualifying user who owns a source folder can move that tree beneath another user's existing folder or into the root namespace, and the operation rekeys the moved ownership and ACL records to the new path. The destination must be unused and existing victim files cannot be overwritten. Distinct pre-fix errors reveal whether a specifically guessed destination path exists, but disclose no directory listing or file contents. This issue is fixed in version 3.23.0.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 14th percentile
Impact if exploited
5.4CVSS 3.1 · MEDIUM
- ConfidentialityLow
- IntegrityLow
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-284: : Improper Access Control
- CWE-639: : Authorization Bypass Through User-Controlled Key
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References and research data (JSON)
All CVSS metrics
- MEDIUM 5.4 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - MEDIUM 5.4 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/error311/FileRise/security/advisories/GHSA-hhc9-q8vh-95p8 CVE record · GitHub_M · Updated 2026-10-14T20:35:46.563Z
CVE record · CISA-ADP · Updated 2026-10-15T15:07:34.533Z
NVD · CVE-2026-103988 · Updated 2026-10-15T16:17:33.020
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101682 EUVD · EUVD-2026-101682
Technical & other
- https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a CVE record · GitHub_M · Updated 2026-10-14T20:35:46.563Z
NVD · CVE-2026-103988 · Updated 2026-10-15T16:17:33.020 - https://github.com/error311/FileRise/releases/tag/v3.23.0 CVE record · GitHub_M · Updated 2026-10-14T20:35:46.563Z
NVD · CVE-2026-103988 · Updated 2026-10-15T16:17:33.020