FKIE_CVE-2026-54414

Vulnerability from fkie_nvd - Published: 2026-06-19 06:17 - Updated: 2026-10-26 11:10
Severity
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).
References
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/error311/FileRise
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/error311/FileRise/releases/tag/v3.16.0
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://github.com/error311/FileRise",
          "defaultStatus": "unaffected",
          "product": "FileRise",
          "programFiles": [
            "src/FileRise/Domain/UploadModel.php",
            "src/FileRise/Support/UploadNamePolicy.php",
            "src/FileRise/Http/Controllers/FolderController.php"
          ],
          "repo": "https://github.com/error311/FileRise",
          "vendor": "error311",
          "versions": [
            {
              "lessThanOrEqual": "3.16.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \\ but not %)."
    },
    {
      "lang": "es",
      "value": "FileRise anterior a la versi\u00f3n 3.16.0 es vulnerable a salto de ruta en el endpoint de carga de carpetas compartidas (/API/folder/uploadToSharedFolder.PHP), lo que lleva a la escritura arbitraria de archivos y a la toma de control de la cuenta de administrador. El nombre de archivo de carga es validado por FolderController con basename() y REGEX_FILE_NAME, que permiten secuencias codificadas en URL (la expresi\u00f3n regular bloquea / y \\ pero no %). El nombre de archivo sin procesar se pasa luego a UploadModel::handleUpload, donde se reconstruye como trim(urldecode(basename($fileName))), reintroduciendo separadores de ruta despu\u00e9s de la validaci\u00f3n (por ejemplo, ..%2fusers%2fusers.txt se convierte en .. / users/users.txt). UploadNamePolicy::isAllowedForWrite() aplica basename() internamente y por lo tanto solo eval\u00faa el componente final (users.txt), permitiendo que la secuencia de salto de ruta pase la pol\u00edtica de extensi\u00f3n. La ruta de destino se utiliza luego directamente en move_uploaded_file() sin una verificaci\u00f3n de contenci\u00f3n de realpath, permitiendo una escritura fuera del directorio de carga previsto. Un atacante que posee un enlace/token de carpeta compartida v\u00e1lido, no caducado y habilitado para carga (los cuales est\u00e1n dise\u00f1ados para ser compartidos p\u00fablicamente) puede sobrescribir users/users.txt para crear una cuenta de administrador, lo que resulta en una toma de control de administrador no autenticada y, dependiendo de la configuraci\u00f3n, ejecuci\u00f3n remota de c\u00f3digo. La explotaci\u00f3n requiere la posesi\u00f3n de un enlace/token de carpeta compartida v\u00e1lido, no caducado y habilitado para carga. Este problema se corrige en la versi\u00f3n 3.16.0, que decodifica la URL antes de la validaci\u00f3n y rechaza cualquier separador de ruta en el nombre de archivo de carga."
    }
  ],
  "id": "CVE-2026-54414",
  "lastModified": "2026-10-26T11:10:00.157",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54414",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-22T15:04:58.077602Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-19T06:17:09.830",
  "references": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://github.com/error311/FileRise"
    },
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023"
    },
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "url": "https://github.com/error311/FileRise/releases/tag/v3.16.0"
    }
  ],
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.