---
id: CVE-2026-54459
title: >-
  FileRise is a self-hosted web-based file manager with multi-file upload,
  editing, and batch operations
summary: >-
  FileRise is a self-hosted web-based file manager with multi-file upload,
  editing, and batch operations. Prior to 3.14.0, FileRise authenticates
  requests to the file creation and share-link creation handlers but does not
  enforce the serve…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-352
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T22:17:04.950'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54459'
references:
  - url: >-
      https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851
    label: security-advisories@github.com
  - url: >-
      https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g
    label: security-advisories@github.com
tags:
  - nvd
ingestedAt: '2026-10-12T23:07:25.637Z'
---

## Overview

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.