FileRise Web-Based File Manager Vulnerability in Archive Extraction

CVE-2026-57491

What is CVE-2026-57491?

FileRise, a self-hosted web-based file manager, exhibits a vulnerability in its archive extraction process. Versions prior to 3.16.0 lack the necessary validation of uploaded filenames, allowing an authenticated user with upload and extract permissions to circumvent security measures. This could result in potentially malicious PHP-family files being extracted and saved to the destination directory, even if uploads of such files are typically rejected. Moreover, post-extraction, the application does not adequately clean up the metadata associated with these files, increasing the risk of code execution within the application environment. Users are advised to update to version 3.16.0 to mitigate this risk.

References