Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint `/api/file/snippet.php` allows an authenticated user with only `read_own` access to a folder to retrieve snippet content from files uploaded by other users in the same folder. This is a server-side authorization flaw in the `read_own` enforcement for hover previews. Version 3.11.0 fixes the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33477 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint `/… https://www.cve.org/CVERecord?id=CVE-2026-33477
Post summary
The annotation notes that CVE-2026-33477 impacts FileRise versions 2.3.7 through 3.10.0 via the file snippet endpoint, but offers no exploitation details, patch information, or PoC reference.
🚨*CVE* CVE-2026-33477 FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint `/… https://www.cve.org/CVERecord?id=CVE-2026-33477 ----- Traducción: CVE-2026-33477 Fil… http://infoflow.cloud`
Post summary
The post merely references CVE-2026-33477 with a short description of affected software, lacking detailed technical data, proof of concept, or active exploitation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | filerise | filerise | - | - | - |