Is CVE-2026-92616 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92616 being exploited in the wild.

How severe is CVE-2026-92616?

Medium severity, with a CVSS score of 6.8, published 16 September 2026.

Which products and versions are affected?

FileRise FileRise before 3.28.0.

Is there a fix for CVE-2026-92616?

A patch was published on 2026-09-16: Fixed in version 3.28.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92616 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-92616?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92616: FileRise privilege escalation in WebDAV session handling

CVE-2026-92616 · Severity: medium · CVSS 6.8 · Published 2026-09-16

FileRise is a file sharing and management application that provides web-based access to files. A privilege escalation vulnerability in versions before 3.28.0 allows authenticated low-privilege users to gain administrative access by exploiting improper session isolation between WebDAV and the main web application, potentially exposing sensitive files and allowing unauthorized modifications to the file system.

Quick answers

Is CVE-2026-92616 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92616 being exploited in the wild.
How severe is CVE-2026-92616?: Medium severity, with a CVSS score of 6.8, published 16 September 2026.
Which products and versions are affected?: FileRise FileRise before 3.28.0.
Is there a fix for CVE-2026-92616?: A patch was published on 2026-09-16: Fixed in version 3.28.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92616 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-92616?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in FileRise's WebDAV interface, which improperly inherits session context from the main web application instead of enforcing independent stateless authentication per RFC 4918. An authenticated attacker with low privileges can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries and gain elevated access to read and write protected resources. The root cause is insufficient session isolation (CWE-613), allowing the WebDAV layer to mistakenly inherit ambient web session privileges rather than validating credentials independently. The vulnerability requires an attacker to have valid credentials and access to an active admin session cookie. Version 3.28.0 and later address this by refining WebDAV request handling to enforce proper session separation.

Affected products

FileRise FileRise before 3.28.0

Timeline

2026-09-16: disclosed
2026-09-16: patched: Fixed in version 3.28.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.