CVE-2026-104107 error311 CVE debrief

Who should care

FileRise administrators and users with access to the application's file management features should assess exposure and prioritize patching. Additionally, security teams and vulnerability management teams should review the vulnerability's impact on their systems and ensure that appropriate mitigations are in place. Operators of FileRise instances, especially those with exposed or internet-facing deployments, should take immediate action to verify patching,

Why it matters

Authenticated path traversal in FileRise 3.22.0 allows attackers to create files outside authorized folders and configured WebDAV roots, given inherited edit permissions and valid sessions. Defenders should prioritize patching to version 3.23.0, restrict access, and monitor for suspicious activities.

• Potential for unauthorized file creation outside configured storage roots
• Possible bypass of intended access controls through inherited ACLs
• Need for verification of patch deployment and system hardening
• Potential for lateral movement if WebDAV credentials are compromised

Technical summary

FileRise 3.22.0's /api/file/saveFile.php operation allows dot and dot-dot segments in folder input before ACL inheritance evaluation. With valid sessions and inherited edit permissions, attackers can create files outside authorized folders and WebDAV roots. The vulnerability arises from the application's failure to canonicalize the folder input before evaluating ACL inheritance, which can lead to unintended file creation. This issue is fixed in version 3.23.0, which properly handles folder input and restricts file creation to authorized areas.

Defensive priority

Medium-priority patching and verification recommended for FileRise instances, especially those exposed to authenticated non-administrator access.

Recommended defensive actions

• Patch FileRise instances to version 3.23.0 or later
• Verify and restrict access to FileRise for authenticated non-administrator users
• Monitor FileRise logs for suspicious file creation activities
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Official CVE and NVD records, along with vendor advisory and fix information, support this debrief. Evidence is limited to public disclosures and may not reflect all affected or exploited systems. The CVE record was published on 2026-10-14T20:42:08.900Z and has not been modified since then. Additional review of the vendor's GitHub repository and release notes confirms the fix in version 3.23.0. However, the exact number of affected systems and the full scope of exploitation remain unknown due to limited public information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.