CSRF Vulnerability in FileRise Web-Based File Manager
CVE-2026-54459

4.3MEDIUM

Key Information:

Vendor

Error311

Status
Filerise
Vendor
CVE Published:
12 October 2026

What is CVE-2026-54459?

FileRise, a self-hosted web-based file manager, is susceptible to a CSRF vulnerability due to inadequate enforcement of server-side token validation in its file creation and share-link creation processes. In versions prior to 3.14.0, the POST endpoints /api/file/createFile.php and /api/file/createShareLink.php fail to reject requests lacking a valid X-CSRF-Token header. This inadequacy allows unauthorized requests issued by an authenticated user to create empty files or generate share links with their permissions. Although the default SameSite=Lax setting for session cookies limits cross-site POST attacks, the vulnerability still poses a significant risk. The issue has been corrected in version 3.14.0.

Affected Version(s)

FileRise < 3.14.0

References

https://github.com/error311/FileRise/security/advisories/...
x_refsource_CONFIRM
https://github.com/error311/FileRise/commit/7035f6ef5a0b3...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.