CVE-2026-57491

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename. Post-extraction metadata pruning does not remove the blocked file, so deployments that execute uploaded content may permit code execution. This issue is fixed in version 3.16.0.

Traduire en français

Produits concernés

• error311 FileRise

Scores CVSS

Faiblesses (CWE)

• CWE-434

Références

• https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6
• https://github.com/error311/FileRise/releases/tag/v3.16.0
• https://github.com/error311/FileRise/security/advisories/GHSA-c4g2-8fg6-5xrr
• https://github.com/error311/FileRise/security/advisories/GHSA-c4g2-8fg6-5xrr

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories