VulnSocial

CVE-2026-33329Disclosure(filerise / filerise)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0.

filerise CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-22CWE-73

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • filerise

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
filerise
Products
filerise

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-24: 1Technical Details · 2026-03-24: 103-24
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-33329 - High FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadMo... https://www.thehackerwire.com/vulnerability/CVE-2026-33329/ https://t.co/z0lIPfthM7

    Post summary

    CVE-2026-33329 is disclosed as a high‑severity vulnerability affecting FileRise web file manager from v1.0.1 through v3.9.x, with the issue tied to the resumableIdentifier parameter in its chunked upload handler.

    0000031
    145 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appfilerisefilerise---

Explore more

Back to dashboardfilerise CVEsfilerise vulnerabilities