Path Traversal Vulnerability in FileRise Web-Based File Manager

CVE-2026-104107

What is CVE-2026-104107?

FileRise, a self-hosted web-based file manager, is affected by a path traversal vulnerability in version 3.22.0. The vulnerability arises from the improper handling of dot and dot-dot segments in the folder input during the /api/file/saveFile.php operation, allowing an attacker with an authenticated non-administrator session and inherited edit permissions to craft requests that could trigger unauthorized file creation outside the intended directory structure. This flaw could allow attackers to manipulate the local filesystem or a WebDAV adapter and create files or directories outside of the authorized content. The issue has been resolved in version 3.23.0, which addresses the improper evaluation of these segments and enhances security measures.

References