FileRise Web-Based File Manager Vulnerability Allows Unauthorized File Overwrites

CVE-2026-104109

What is CVE-2026-104109?

FileRise, a self-hosted web-based file management tool, contains a vulnerability that allows authenticated users with extract permissions to perform unauthorized file operations. Prior to version 3.23.0, the application fails to adequately validate archive entry names before extracting them to the live environment. This can lead to a situation where an attacker could exploit this flaw by uploading a malicious ZIP file containing symlink references, potentially overwriting files outside the intended directory. The risk arises when a symlink exists in the destination folder that points outside the storage root, allowing the exploit to occur. To mitigate this issue, users are advised to upgrade to version 3.23.0, which contains the necessary security enhancements.

References