Web File Manager Vulnerability in FileRise by error311
CVE-2026-33071

4.3MEDIUM

Key Information:

Vendor

Error311

Status
Filerise
Vendor
CVE Published:
20 March 2026

What is CVE-2026-33071?

The FileRise web file manager has a vulnerability that allows remote code execution due to inadequate validation of uploaded file names at the WebDAV upload endpoint. Users can upload files with dangerous extensions like .phtml and .php5 without detection, especially in configurations lacking adequate server protections. This issue stems from the method calls in the FileRise code that accept filenames directly from the client without proper scrutiny, unlike the regular upload process which employs filename validation. The vulnerability is resolved in version 3.8.0, which introduces necessary checks to prevent such security breaches.

Affected Version(s)

FileRise < 3.8.0

References

https://github.com/error311/FileRise/security/advisories/...
x_refsource_CONFIRM
https://github.com/error311/FileRise/releases/tag/v3.8.0
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.