| Package | Affected versions | Patched versions |
|---|---|---|
| No affected product versions are listed for this vulnerability yet. | ||
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free