CVE-2025-62510 FileRise insecure folder visibility via name-based mapping and incomplete ACL checks

High 8.1 Published 20 Oct 2025 Updated 20 Oct 2025

Low-privilege users can access other users' folders due to insecure name-based mapping and incomplete ACL checks in FileRise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-62510?

CVE-2025-62510 is a high-severity missing authorization vulnerability in error311 FileRise, published on 20 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their username and, in some cases, other users’ content. This issue has been patched in version 1.5.0, where it introduces explicit per-folder ACLs (owners/read/write/share/read_own) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.

Weakness: CWE-284, CWE-280

Which versions are affected by CVE-2025-62510?

It affects 1 product.

Products include Filerise Filerise.

How do I fix CVE-2025-62510?

No fix has been published for CVE-2025-62510 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-62510 being exploited?

There is no known exploitation of CVE-2025-62510 in the wild and no public exploit code.

Sources

Also known as GHSA-jm96-2w52-5qjj.