CVE-2026-61844 error311 CVE debrief

Who should care

Defenders responsible for FileRise installations should assess exposure and prioritize upgrading to version 3.18.0 or later to prevent potential unauthorized file access and modification.

Why it matters

Defenders should care about CVE-2026-61844 because it allows a low-privileged user to potentially access and modify files of another user in FileRise installations prior to version 3.18.0. This requires verification of affected versions, inventory checks, and prompt remediation to prevent exploitation.

• Potential unauthorized file access
• Potential unauthorized file modification
• Need to verify and upgrade to version 3.18.0 or later
• Possible lateral movement through file system

Technical summary

FileRise, a self-hosted web-based file manager, had a vulnerability prior to version 3.18.0 where logical folder paths were flattened into metadata filenames. This allowed a low-privileged user to alter metadata and potentially read and modify files of another user if certain conditions were met. The vulnerability exists due to the way FileRise handles folder metadata filenames. A low-privileged user can exploit this by controlling a colliding folder and knowing the target basename, potentially allowing them to read and modify files of another user. This issue is fixed in version 3.18.0. Defenders should prioritize upgrading to version 3.18.0 or later to prevent potential unauthorized file access and

Defensive priority

Defenders should prioritize upgrading to version 3.18.0 or later to prevent potential unauthorized file access and modification.

Recommended defensive actions

• Upgrade to FileRise version 3.18.0 or later
• Restrict access to sensitive folders and files
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists due to the way FileRise handles folder metadata filenames. A low-privileged user can exploit this by controlling a colliding folder and knowing the target basename, potentially allowing them to read and modify files of another user.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.