CVE Intelligence
Analysis AI-assisted

CVE-2026-54414: FileRise Path Traversal in Shared-Folder Upload Endpoint

According to the CVE record, FileRise versions before 3.16.0 contain a path traversal flaw in the shared-folder upload endpoint. The record describes arbitrary file write and administrator account takeover, with a CVSS 3.1 base score of 9.8. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

According to the CVE record, FileRise versions before 3.16.0 contain a path traversal flaw in the shared-folder upload endpoint, /api/folder/uploadToSharedFolder.php. The upload filename is checked by FolderController using basename and REGEX_FILE_NAME. The record says this regex blocks forward slashes and backslashes but not percent signs, so URL-encoded sequences are accepted.

Impact

  • The record states that the flaw leads to arbitrary file write on the server.
  • The record states that it leads to administrator account takeover.
  • The CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates network reachability, low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability.
  • The CNA also provided a CVSS 4.0 base score of 9.3.

Affected products and versions

  • FileRise versions before 3.16.0, as stated in the record.
  • The structured affected list in the record is empty, so exact version ranges beyond this statement are unknown.
  • The project repository and the v3.16.0 release are listed as references.

Exploitation status

  • The CISA KEV entry is not listed in the record (listed is false).
  • No confirmed exploitation in the wild appears in the sources consulted.
  • No EPSS data is available in the record.

Remediation and mitigation

  • Upgrade FileRise to version 3.16.0 or later, the version boundary stated in the record.
  • Until the upgrade is applied, restrict who can reach the shared-folder upload functionality and avoid exposing it to untrusted networks.
  • Review administrator accounts and recent privilege or credential changes.
  • Limit the web application's file system write permissions to only the directories it requires.
  • Keep current backups of configuration and user data so unexpected changes can be reverted.

Detection guidance

  • Review web server and application logs for requests to the shared-folder upload endpoint, paying attention to filenames with unusual encoded characters.
  • Look for newly created or modified files outside the expected upload directories, especially files appearing in web-served or application configuration paths.
  • Audit recent administrator logins, newly created administrator accounts and changes to user credentials.

Limitations of the available information

  • The record has no title, no structured affected or fixed version data, and no KEV or EPSS data.
  • The source status is Deferred, so details may change as the record is updated.
  • Whether a given deployment is exposed depends on its configuration, which the sources do not describe.
  • No technical proof-of-concept details are provided in the record, and this analysis does not add them.

Frequently asked questions

Which FileRise versions are affected by CVE-2026-54414?

According to the CVE record, versions before 3.16.0 are affected. The structured affected list in the record is empty, so no further version ranges can be confirmed from it.

Is this vulnerability being actively exploited?

The record shows no KEV listing. No confirmed exploitation in the wild appears in the sources consulted.

What should administrators do now?

Upgrade FileRise to version 3.16.0 or later, restrict access to the shared-folder upload functionality until then, and review administrator accounts and recent credential changes.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.