Vulnerability · Published Feb 9, 2026 · Assigned by GitHub_M

CVE-2026-25231FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control

High 7.5

In plain English

A high-severity improper access control in FileRise from error311. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.7%top 23.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 3.3.0, the application contains an unauthenticated file read vulnerability due to the lack of access control on the /uploads directory. Files uploaded to this directory can be accessed directly by any user who knows or can guess the file path, without requiring authentication. As a result, sensitive data could be exposed, and privacy may be breached. This vulnerability is fixed in 3.3.0.

Affected products (as reported)

Vendor	Product	Versions
error311	FileRise	< 3.3.0

Weakness: CWE-284, CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/error311/FileRise/security/advisories/GHSA-hv99-77cw-hvpr x_refsource_CONFIRM
https://github.com/error311/FileRise/releases/tag/v3.3.0 x_refsource_MISC