Stored XSS Vulnerability in FileRise Web-Based File Manager
CVE-2025-66403

4.6MEDIUM

Key Information:

Vendor

Error311

Status
Filerise
Vendor
CVE Published:
1 December 2025

What is CVE-2025-66403?

FileRise, a self-hosted file manager, has a stored cross-site scripting (XSS) vulnerability due to the inadequate handling of user-uploaded SVG files before version 2.2.3. The application permits the upload of SVG files without proper sanitization, allowing malicious SVG content with embedded scripts to execute. When these malicious files are rendered in a user’s browser, they can carry out unwanted actions in the context of the application, posing significant security threats. The vulnerability has been rectified in version 2.2.3.

Affected Version(s)

FileRise < 2.2.3

References

https://github.com/error311/FileRise/security/advisories/...
x_refsource_CONFIRM
https://github.com/error311/FileRise/commit/f2ce43f18f044...
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.