{"id":"CVE-2026-54459","title":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations","summary":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the serve…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwe":["CWE-352"],"published":"2026-10-12","updated":"2026-10-12","sourceUpdated":"2026-10-12T22:17:04.950","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54459","references":[{"url":"https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851","label":"security-advisories@github.com"},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","label":"security-advisories@github.com"}],"tags":["nvd"],"ingestedAt":"2026-10-12T23:07:25.637Z","slug":"CVE-2026-54459","body":"## Overview\n\nFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}