FileRise Vulnerability in Web-Based File Manager Affects Version Prior to 3.18.0

CVE-2026-61844

What is CVE-2026-61844?

FileRise, a self-hosted web-based file manager, suffers from a file path collision vulnerability that affects versions prior to 3.18.0. The issue arises when the system flattens logical folder paths into metadata filenames by replacing folder separators and spaces with hyphens. This results in distinct folders potentially sharing the same metadata file. A low-privileged user controlling a colliding folder can exploit their read_own access, allowing them to change the metadata associated with a target folder. Consequently, they can make files appear as if they are owned by the attacker, gaining the ability to read and modify those files if they hold edit-own permissions. The vulnerability has been addressed in version 3.18.0.

References