CVE-2026-33477
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.
Published Mar 26, 2026 · updated Jun 17, 2026 · filerise filerise
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint allows an authenticated user with only access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the enforcement for hover previews. Version 3.11.0 fixes the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 26, 2026 · NIST NVD
Detected
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint allows an authenticated user with only access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the enforcement for hover previews. Version 3.11.0
Jun 17, 2026 · NIST NVD
Updated
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint allows an authenticated user with only access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the enforcement for hover previews. Version 3.11.0
Affected
- cpe filerise/fileriseversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33477
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33477
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint allows an authenticated user with only access to a folder to retrieve snippet con
nvd.nist.gov