Symlink Vulnerability in FileRise Self-Hosted File Manager

CVE-2026-55498

What is CVE-2026-55498?

FileRise, a self-hosted web-based file manager, is vulnerable to a symlink traversal issue that allows unauthorized access to files outside of shared folders. Prior to version 3.15.0, users with a valid share token could exploit this vulnerability to navigate through shared-folder links to sibling directories beyond the intended access boundaries. This is due to the application's failure to properly enforce access restrictions on shared-folder paths when resolving symbolic links, posing a significant risk to sensitive file information.

References