Description (CNA)
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| error311 / FileRise | affected 0 through 3.16.0 |
CWE
CWE-22, CWE-434
References
- https://github.com/error311/FileRise/releases/tag/v3.16.0
- https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023
- https://github.com/error311/FileRise
ADP enrichment
No English description supplied.
No references supplied.