Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92616FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance

Medium 6.8

In plain English

A medium-severity security flaw in FileRise from error311. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 66.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries, as the WebDAV layer incorrectly inherits elevated privileges from an ambient web session rather than enforcing independent stateless authentication per RFC 4918.

Affected products (as reported)

Vendor	Product	Versions
error311	FileRise	0 – before 3.28.0

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

FileRise v3.28.0 Release Notes patch, release-notes
VulnCheck Advisory third-party-advisory