Description
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| error311 | FileRise | ≤ 3.16.0 | — |
References
- Fixed release v3.16.0 patch
- Vulnerable decode-after-validate (UploadModel.php, v3.15.0) technical-description
- https://github.com/error311/FileRise product