FileRise <= 3.3.0 - Unauthenticated File Read

highseverity

7.5CVSS score

1.7%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

FileRise <= 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths.

Impact

Unauthenticated attackers can access sensitive uploaded files, leading to data exposure and privacy breaches.

Fix

Upgrade to version 3.3.0 or later.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(to_lower(body), '<title>filerise') and contains_any(body, 'api/auth/login_basic.php', 'js/main.js')
Send: GET /uploads/README.md
Positive when: status_code == 200 and len(body) > 0 and !contains(to_lower(content_type), 'text/html') and !contains(to_lower(body), '<title')
Send: GET /uploads
Positive when: status_code == 301 and contains(header, '/uploads/')

Run it with nuclei: nuclei -id CVE-2026-25231 -u <target>

The full check

id: CVE-2026-25231

info:
  name: FileRise <= 3.3.0 - Unauthenticated File Read
  author: str4k3r
  severity: high
  description: |
    FileRise <= 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths.
  impact: |
    Unauthenticated attackers can access sensitive uploaded files, leading to data exposure and privacy breaches.
  remediation: |
    Upgrade to version 3.3.0 or later.
  reference:
    - https://github.com/error311/FileRise/security/advisories/GHSA-hv99-77cw-hvpr
    - https://github.com/error311/FileRise
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 3
    vendor: error311
    product: filerise
    shodan-query: 'http.title:"FileRise"'
    fofa-query: 'title="FileRise"'
    google-query: 'intitle:"FileRise"'
  tags: cve,cve2026,filerise,exposure,file-read

flow: http(1) && (http(2) || http(3))

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(to_lower(body), '<title>filerise')"
          - "contains_any(body, 'api/auth/login_basic.php', 'js/main.js')"
        condition: and
        internal: true

  - raw:
      - |
        GET /uploads/README.md HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "len(body) > 0"
          - "!contains(to_lower(content_type), 'text/html')"
          - "!contains(to_lower(body), '<title')"
        condition: and

  - raw:
      - |
        GET /uploads HTTP/1.1
        Host: {{Hostname}}

    redirects: false
    matchers:
      - type: dsl
        dsl:
          - "status_code == 301"
          - "contains(header, '/uploads/')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from