FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens logical folder paths into metadata filenames by replacing separators and spaces with hyphens, so distinct folders such as team/docs and team-docs can share one metadata file. Because uploader metadata is used to authorize read_own and ownership-restricted edits, a low-privileged user who controls one colliding folder, knows the target basename, and already has read_own access to the target folder can alter the metadata used by that folder, make the victim file appear attacker-owned, read it, and modify it when edit-own permission is also available.
This issue is fixed in version 3.18.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/error311/FileRise/commit/9ed1a38f00918849dbda30f54291d1451ed…
security-advisories@github.com
https://github.com/error311/FileRise/releases/tag/v3.18.0
security-advisories@github.com
https://github.com/error311/FileRise/security/advisories/GHSA-qpm8-pgmq-wxmh
security-advisories@github.com