CVE-2026-92616

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.28.0

Description Improper session isolation between the WebDAV interface and the web application session context allows authenticated low-privilege attackers to gain unauthorized read and write access. By combining valid Basic-Auth credentials with an active admin PHPSESSID cookie, attackers can bypass authorization boundaries. This occurs because the WebDAV layer incorrectly inherits elevated privileges from an ambient web session instead of enforcing independent stateless authentication as required by RFC 4918.

Recommendations Update to version 3.28.0 or later.