CVE-2026-62664 error311 CVE debrief

Who should care

Defenders responsible for FileRise installations, particularly those with low-privileged user accounts, should assess exposure and prioritize upgrading to version 3.19.0 or later. They should also restrict write permissions to the web-server account and monitor directory creation for suspicious activity. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest,

Why it matters

This vulnerability allows authenticated low-privileged users to create directories outside the upload root, potentially leading to unauthorized directory creation and elevation of privileges. Defenders should prioritize verifying and upgrading to version 3.19.0 or later, restricting write permissions, and monitoring directory creation.

• Potential for unauthorized directory creation
• Possible elevation of privileges
• Need for verification of affected versions and remediation
• Importance of monitoring directory creation for suspicious activity

Technical summary

FileRise, a self-hosted web-based file manager, is vulnerable to authenticated path traversal in its createFolder function. This allows an authenticated low-privileged user to create directories outside the designated upload root directory, potentially leading to unauthorized directory creation and elevation of privileges. The issue is fixed in version 3.19.0, and defenders should prioritize verifying and upgrading to this version or later, restricting write permissions, and monitoring directory creation for suspicious activity.

Defensive priority

Defenders should prioritize verifying and upgrading to version 3.19.0 or later, restricting write permissions, and monitoring directory creation.

Recommended defensive actions

• Verify and upgrade to version 3.19.0 or later
• Restrict write permissions to the web-server account
• Monitor directory creation for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and fixed version. The vulnerability allows authenticated low-privileged users to create directories outside the upload root, potentially leading to unauthorized directory creation and elevation of privileges. Defenders should verify and upgrade to version 3.19.0 or later, restrict write permissions, and monitor directory creation. Evidence limits suggest verifying affected scope, severity, and vendor guidance through official advisories or CVE.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.