filerise records

12 published records for vendor filerise.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 83.3%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

12 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-33071No exploit	FileRise: WebDAV upload path bypasses filename validation enforced by regular uploadsfilerise · filerise · CWE-434 RCE File upload	High8.8	—	0.6%	Mar 20, 2026
32Monitor	CVE-2026-33329No exploit	FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oraclefilerise · filerise · CWE-22 Path traversal	High8.1	—	0.4%	Mar 24, 2026
32Monitor	CVE-2025-62509No exploit	FileRise improper ownership/permission validation allowed cross-tenant file operationsfilerise · filerise · CWE-280 Broken access control (IDOR)	High8.1	—	0.3%	Oct 20, 2025
32Monitor	CVE-2025-62510No exploit	FileRise insecure folder visibility via name-based mapping and incomplete ACL checksfilerise · filerise · CWE-280	High8.1	—	0.3%	Oct 20, 2025
31Monitor	CVE-2026-25231Proof of concept	FileRise affected by an Unauthenticated File Read Due to Insufficient Access Controlfilerise · filerise · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	1.7%	Feb 9, 2026
30Monitor	CVE-2026-33072No exploit	FileRise: Default Encryption Key Enables Token Forgery and Config Decryptionfilerise · filerise · CWE-798 Pre-auth File upload Hard-coded credentials	High7.5	—	0.2%	Mar 20, 2026
28Monitor	CVE-2026-33330No exploit	FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callbackfilerise · filerise · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Mar 24, 2026
21Monitor	CVE-2025-68116Proof of concept	FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handlingfilerise · filerise · CWE-79 XSS	Medium5.4	—	0.2%	Dec 16, 2025
21Monitor	CVE-2026-25230No exploit	FileRise affected by HTML Injection using color property in file tagsfilerise · filerise · CWE-79 XSS	Medium5.4	—	0.2%	Feb 9, 2026
21Monitor	CVE-2025-66403No exploit	FileRise Vulnerable to Stored XSS via SVG Uploadfilerise · filerise · CWE-79 XSS	Medium5.4	—	0.2%	Dec 1, 2025
19Monitor	CVE-2026-33070No exploit	FileRise has Unauthenticated Share Link Deletionfilerise · filerise · CWE-306 Pre-auth Auth bypass CSRF	Medium4.8	—	0.3%	Mar 20, 2026
17Monitor	CVE-2026-33477No exploit	FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file contentfilerise · filerise · CWE-863 Broken access control (IDOR)	Medium4.3	—	0.2%	Mar 26, 2026

CVE-2026-33071
35Monitor
FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
filerise · fileriseMar 20, 2026
CVE-2026-33329
32Monitor
FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
filerise · fileriseMar 24, 2026
CVE-2025-62509
32Monitor
FileRise improper ownership/permission validation allowed cross-tenant file operations
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
filerise · fileriseOct 20, 2025
CVE-2025-62510
32Monitor
FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
HighCVSS 8.1No exploitEPSS 0%
filerise · fileriseOct 20, 2025
CVE-2026-25231
31Monitor
FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
HighCVSS 7.5Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
filerise · fileriseFeb 9, 2026
CVE-2026-33072
30Monitor
FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
HighCVSS 7.5No exploitEPSS 0%
filerise · fileriseMar 20, 2026
CVE-2026-33330
28Monitor
FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
filerise · fileriseMar 24, 2026
CVE-2025-68116
21Monitor
FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling
MediumCVSS 5.4Proof of conceptEPSS 0%
- XSS
filerise · fileriseDec 16, 2025
CVE-2026-25230
21Monitor
FileRise affected by HTML Injection using color property in file tags
MediumCVSS 5.4No exploitEPSS 0%
- XSS
filerise · fileriseFeb 9, 2026
CVE-2025-66403
21Monitor
FileRise Vulnerable to Stored XSS via SVG Upload
MediumCVSS 5.4No exploitEPSS 0%
- XSS
filerise · fileriseDec 1, 2025
CVE-2026-33070
19Monitor
FileRise has Unauthenticated Share Link Deletion
MediumCVSS 4.8No exploitEPSS 0%
filerise · fileriseMar 20, 2026
CVE-2026-33477
17Monitor
FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content
MediumCVSS 4.3No exploitEPSS 0%
- Broken access control (IDOR)
filerise · fileriseMar 26, 2026