CVE-2026-54414

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.16.0

Description A path traversal issue exists in the shared-folder upload endpoint '/api/folder/uploadToSharedFolder.php'. The FolderController validates the upload filename using basename() and REGEX FILE NAME, but these permit URL-encoded sequences. The raw filename is subsequently processed by UploadModel::handleUpload, where it is reconstructed using trim(urldecode(basename($fileName))), re-introducing path separators after the initial validation. Because UploadNamePolicy::isAllowedForWrite() only evaluates the final component of the path, traversal sequences can bypass extension policies. The destination path is then used in move uploaded file() without a realpath containment check, enabling arbitrary file writes outside the intended directory. An attacker with a valid, non-expired, upload-enabled shared-folder link or token can overwrite users/users.txt to create an administrator account, potentially leading to unauthenticated admin takeover and remote code execution.

Recommendations Update to version 3.16.0.