FileRise provides security fixes for the latest minor release line only.

If you’re on an older minor line, please upgrade to the latest release to receive security fixes.

Please do not open a public issue. Use one of the private channels below:

1. GitHub Security Advisory (preferred)
   Open a private report here: https://github.com/error311/FileRise/security/advisories/new

2. Email
   Send details to security@filerise.net with subject: [FileRise] Security Vulnerability Report.

• Affected versions, component/endpoint, and impact
• Reproduction steps / PoC
• Any logs, screenshots, or crash traces
• Safe test scope used (see below)

If you’d like encrypted comms, ask for our PGP key in your first email.

• Acknowledgement: within 48 hours
• Triage & initial assessment: within 7 days
• Fix target: within 30 days for high-severity issues (may vary by complexity)
• CVE & advisory: we publish a GitHub Security Advisory and request a CVE when appropriate.
  We aim to notify the reporter before public disclosure and credit them (unless they prefer to remain anonymous).

We support good-faith research. Please:

• Avoid privacy violations, data exfiltration, and service disruption (no DoS, spam, or brute-forcing)
• Don’t access other users’ data beyond what’s necessary to demonstrate the issue
• Don’t run automated scans against production installs you don’t own
• Follow applicable laws and make a good-faith effort to respect data and availability

If you follow these guidelines, we won’t pursue or support legal action.

CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in the upstream PHP runtime that can permit unauthenticated remote code execution. FileRise deployments using an unpatched PHP runtime are affected, including older official Docker images.

Docker: The official error311/filerise-docker:v3.38.0 images have been verified on AMD64 and ARM64 to contain the patched PHP packages described below. Pull this image or a newer release containing these PHP fixes and recreate your container with the same volumes, configuration, and persistent tokens key. Restarting an older container or replacing FileRise application files alone does not update PHP.

For Ubuntu 24.04, both vulnerabilities are fixed in PHP package revision 8.3.6-0ubuntu0.24.04.13. Verify that the image contains this revision or a later fixed revision of libapache2-mod-php8.3, php8.3-cli, and php8.3-common. The PHP version banner can still display 8.3.6 because Ubuntu backports the fixes; check the complete package revision. See Ubuntu USN-8948-1.

Manual installations: Update PHP separately through your operating system or hosting provider to a patched release, such as PHP 8.3.36 or a vendor package containing both fixes, and restart Apache or every PHP-FPM worker. Updating FileRise application files alone does not patch PHP.

FileRise also disables PHP's unused session upload-progress feature in its Docker PHP configuration as defense in depth. FileRise's own upload progress and resumable uploads remain supported. This setting does not replace the required PHP security update.

These upstream vulnerabilities are tracked under the existing PHP CVE identifiers above. FileRise's remediation and upgrade instructions are documented here, in the v3.38.0 changelog, and in the upgrade guide.

• GHSA-hv99-77cw-hvpr - <= 3.2.3: Unauthenticated File Read Due to Insufficient Access Control Fixed in: 3.3.0 and later. Thanks to Marcel Graf (AWARE7 GmbH) @ByteTyson for responsible disclosure and verification of the fix.

• GHSA-h8fw-42v6-gfhv - <= 3.2.3: HTML Injection using color property in file tags Fixed in: 3.3.0 and later. Thanks to Marcel Graf (AWARE7 GmbH) @ByteTyson for responsible disclosure and verification of the fix.

• GHSA-35pp-ggh6-c59c — < 2.7.1: Stored XSS via browser-rendered user uploads (SVG primary; HTML rendering via share links also documented).
  Fixed in: 2.7.1. Thanks to @x0root for responsible disclosure.
  Note: Related reports covering the same root cause and affected endpoint(s) were consolidated into this advisory to avoid duplicate tracking/CVEs.

• GHSA-6p87-q9rh-95wh — ≤ 1.3.15: Improper ownership/permission validation allowed cross-tenant file operations.
  Fixed in: 1.5.0 and later.

• GHSA-jm96-2w52-5qjj — v1.4.0: Insecure folder visibility via name-based mapping and incomplete ACL checks.
  Fixed in: 1.5.0 and later.

• GHSA-vh5m-w36c-99xv / CVE-2026-33070 — < 3.8.0: Unauthenticated Share Link Deletion.
  Fixed in: 3.8.0 and later. Thanks to n0rv-TvT for responsible disclosure.

• GHSA-46gv-gf5f-wvr2 / CVE-2026-33071 — < 3.8.0: WebDAV upload path bypasses filename validation enforced by regular uploads.
  Fixed in: 3.8.0 and later. Thanks to n0rv-TvT for responsible disclosure.

• GHSA-f4xx-57cv-mg3x / CVE-2026-33072 — < 3.9.0: Default Encryption Key Enables Token Forgery and Config Decryption.
  Fixed in: 3.9.0 and later. Thanks to n0rv-TvT for responsible disclosure.

• GHSA-c2jm-4wp9-5vrh / CVE-2026-33329 — < 3.10.0: Path Traversal in resumableIdentifier Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle.
  Fixed in: 3.10.0 and later. Thanks to kq5y for responsible disclosure.

• GHSA-6c3j-f4x4-36m3 / CVE-2026-33330 — < 3.10.0: FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback.
  Fixed in: 3.10.0 and later. Thanks to bg0d-glitch for responsible disclosure.

• GHSA-62wx-vp78-2p83 / CVE-2026-33477 - < 3.11.0: Incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content Fixed in: 3.11.0 and later. Thanks to bg0d-glitch for responsible disclosure.

Thanks to @kiwi865, @ByteTyson, @x0root, n0rv-TvT, kq5y, and bg0d-glitch for responsible disclosure of issues.

General security questions: admin@filerise.net