Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-33477 EUVD-2026-16277

FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content

Published Mar 26, 2026 · Updated Mar 26, 2026 · Assigned by GitHub_M

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint `/api/file/snippet.php` allows an authenticated user with only `read_own` access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the `read_own` enforcement for hover previews. Version 3.11.0 fixes the issue.

Affected products

VendorProductAffectedFixed
error311 FileRise >= 2.3.7, < 3.11.0 —

References