Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M

CVE-2026-33329FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle

High 8.1

In plain English

A high-severity path traversal in FileRise from error311. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 59.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.

Affected products (as reported)

Vendor	Product	Versions
error311	FileRise	>= 1.0.1, < 3.10.0

Weakness: CWE-22, CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References

https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh x_refsource_CONFIRM
https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c x_refsource_MISC
https://github.com/error311/FileRise/releases/tag/v3.10.0 x_refsource_MISC