CVE-2026-104110: falha de média gravidade em error311 FileRise
FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
Publicada em
30Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3
da publicação à arma0 dias
Publicada no NVD14 de out.
1ª PoC1 de out.
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug. The response includes the internal storage folder path, client contact email, form settings, and upload-policy details, while the separate publicMeta.php endpoint intentionally exposes only curated branding data. Exploitation requires the Pro add-on and at least one configured portal. This issue is fixed in version 3.24.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
error311 · FileRisePoCs públicas encontradas — 1
githubgithub.com/pervinzahidli/CVE-2026-104110★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — error311 FileRise
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25231HIGHFileRise affected by an Unauthenticated File Read Due to Insufficient Access ControlEPSS 1.7%CVE-2026-33071MEDIUMFileRise: WebDAV upload path bypasses filename validation enforced by regular uploadsEPSS 0.7%CVE-2026-54414CRITICALFileRise shared-folder upload path traversal allows arbitrary file write and admin takeoverEPSS 0.7%CVE-2026-33329HIGHFileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence OracleEPSS 0.6%CVE-2026-92616HIGHFileRise < 3.28.0 Privilege Escalation via WebDAV Session InheritanceEPSS 0.4%CVE-2026-33330HIGHFileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callbackEPSS 0.4%