CVE-2026-104109 error311 CVE debrief

Who should care

FileRise administrators, security teams, and users with extract permissions should assess exposure and verify remediation. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-104109 is a medium-severity vulnerability in FileRise that allows authenticated non-administrators to overwrite and delete external files. Defenders should verify and remediate this vulnerability to prevent potential data loss or corruption.

• Potential for data loss or corruption through file overwrite
• Possible deletion of external files through symlink attack
• Need for verification of FileRise version and remediation
• Potential for lateral movement or privilege escalation

Technical summary

FileRise, a self-hosted web-based file manager, validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. This allows an authenticated non-administrator with extract permission to overwrite external files and delete them through a symlink attack. The vulnerability is fixed in version 3.23.0, and administrators should verify and remediate this vulnerability to prevent potential data loss or corruption. The issue requires verification of FileRise version and remediation to prevent potential data loss or corruption.

Defensive priority

Medium priority for FileRise administrators and security teams to verify and remediate.

Recommended defensive actions

• Verify FileRise version and upgrade to 3.23.0 or later
• Restrict extract permissions to administrators only
• Monitor FileRise logs for suspicious activity
• Implement additional security controls for file uploads and extraction
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information on exploitation and impact. Official sources include CVE Program, NVD, and cve_program_cvelist_v5. The CVE Program record was published on 2026-10-14T20:44:29.439Z and has not been modified since then. The advisory does not establish that the attacker can create the prerequisite symlink through FileRise. There is no information on known or unknown affected scope, and defenders should verify the vulnerability and remediate it to prevent data or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.