CVE-2025-68116 FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling
Attackers can execute arbitrary JavaScript in victims' browsers by uploading malicious SVG or HTML files to FileRise, leading to potential session hijacking or data theft.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-68116?
CVE-2025-68116 is a high-severity cross-site scripting vulnerability in error311 FileRise, published on 16 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site Scripting (XSS) due to unsafe handling of browser-renderable user uploads when served through the sharing and download endpoints. An attacker who can get a crafted SVG (primary) or HTML (secondary) file stored in a FileRise instance can cause JavaScript execution when a victim opens a generated share link (and in some cases via the direct download endpoint). This impacts share links (`/api/file/share.php`) and direct file access / download path (`/api/file/download.php`), depending on browser/content-type behavior. Version 2.7.1 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2025-68116?
It affects 1 product.
Products include Filerise Filerise.
How do I fix CVE-2025-68116?
No fix has been published for CVE-2025-68116 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-68116 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68116 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in error311 FileRise
- CVE-2026-33072 FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
- CVE-2026-33329 Path traversal in FileRise
- CVE-2025-62509 FileRise improper ownership/permission validation allowed cross-tenant file operations
- CVE-2025-62510 FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
- CVE-2026-25231 FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control
Sources
Also known as GHSA-35pp-ggh6-c59c.