Executive brief
FileRise is a file sharing and management application that provides web-based access to files. A privilege escalation vulnerability in versions before 3.28.0 allows authenticated low-privilege users to gain administrative access by exploiting improper session isolation between WebDAV and the main web application, potentially exposing sensitive files and allowing unauthorized modifications to the file system.
Technical details
The vulnerability exists in FileRise's WebDAV interface, which improperly inherits session context from the main web application instead of enforcing independent stateless authentication per RFC 4918. An authenticated attacker with low privileges can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries and gain elevated access to read and write protected resources. The root cause is insufficient session isolation (CWE-613), allowing the WebDAV layer to mistakenly inherit ambient web session privileges rather than validating credentials independently. The vulnerability requires an attacker to have valid credentials and access to an active admin session cookie. Version 3.28.0 and later address this by refining WebDAV request handling to enforce proper session separation.
Affected products
- FileRise FileRise before 3.28.0
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fixed in version 3.28.0