Unrestricted Information Exposure in FileRise Pro Web-based File Manager
CVE-2026-104110

5.3MEDIUM

Key Information:

Vendor

Error311

Status
Filerise
Vendor
CVE Published:
14 October 2026

What is CVE-2026-104110?

FileRise Pro, a self-hosted web-based file management tool, is prone to an information exposure issue that allows unauthenticated users to gain access to sensitive internal records linked to a configured client portal. This vulnerability exists in versions prior to 3.24.0 and arises from the /api/pro/portals/get.php endpoint, which inadvertently returns comprehensive details such as the internal storage folder path, client contact email, form settings, and upload-policy details when prompted with the correct portal slug. Although an additional endpoint, publicMeta.php, is designed to disclose only non-sensitive branding data, the primary API's unintended data exposure poses a significant risk, especially when the Pro add-on is enabled. The vulnerability has been addressed in version 3.24.0.

Affected Version(s)

FileRise < 3.24.0

References

https://github.com/error311/FileRise/security/advisories/...
x_refsource_CONFIRM
https://github.com/error311/FileRise/commit/1bf1f44d22139...
x_refsource_MISC
https://github.com/error311/FileRise/releases/tag/v3.24.0
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.