FileRise: Unauthenticated file overwrite via upload-enabled shared folders
Summary
FileRise, a self-hosted web file manager, does not reject uploads whose destination filename already exists in upload-enabled shared-folder and upload-only links. An unauthenticated visitor with a valid share token and the share password can upload a file with the same name as an existing file and silently replace its content, while the original uploader metadata remains. Authenticated users and upload-only users without edit rights on the target file can also overwrite files through the upload API.
Affected
- FileRise versions prior to 3.18.0
Fixed in
- Upgrade to FileRise 3.18.0 or later
Workaround
- Unknown. No vendor workaround is documented.
- Until the upgrade, disable upload-enabled public shares and upload-only links, and review existing share links.
Exploitation
- No public proof of concept or in-the-wild exploitation known.
- Not listed in CISA KEV. CISA SSVC: exploitation poc, automatable yes, technical impact partial.
Our recommendation
- Upgrade FileRise to version 3.18.0 or later, preferably in the next maintenance window or sooner if the instance is internet-facing.
- Until then, disable upload-enabled share links and rotate share passwords.
- Review existing share links and check recent uploads for unexpected file replacements.
- Back up the upload directory before upgrading.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Official commit 9ed1a38 (v3.18.0 fix) github.com
- FileRise v3.18.0 release github.com
- GitHub Security Advisory GHSA-r787-5hp3-4874 github.com
- OSV entry CVE-2026-61843 osv.dev
- OpenCVE CVE-2026-61843 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:14.
Original description (NVD)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.