Shaxzod Turgunov

**Name of the Vulnerable Software and Affected Versions** FileRise versions prior to 3.16.0 **Description** A path traversal issue exists in the shared-folder upload endpoint '/api/folder/uploadToSharedFolder.php'. The `FolderController` validates the upload filename using `basename()` and `REGEX FILE NAME`, but these permit URL-encoded sequences. The raw filename is subsequently processed by `UploadModel::handleUpload`, where it is reconstructed using `trim(urldecode(basename($fileName)))`, re-introducing path separators after the initial validation. Because `UploadNamePolicy::isAllowedForWrite()` only evaluates the final component of the path, traversal sequences can bypass extension policies. The destination path is then used in `move uploaded file()` without a realpath containment check, enabling arbitrary file writes outside the intended directory. An attacker with a valid, non-expired, upload-enabled shared-folder link or token can overwrite `users/users.txt` to create an administrator account, potentially leading to unauthenticated admin takeover and remote code execution. **Recommendations** Update to version 3.16.0.