CVE-2026-54414 FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
Attackers can exploit path traversal in FileRise to write arbitrary files and take over administrator accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54414?
CVE-2026-54414 is a critical path traversal vulnerability in error311 FileRise, published on 19 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \ but not %).
Which versions are affected by CVE-2026-54414?
How do I fix CVE-2026-54414?
No fix has been published for CVE-2026-54414 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54414 being exploited?
There is no known exploitation of CVE-2026-54414 in the wild and no public exploit code.
Sources
Also known as GHSA-jg2q-3m38-6xc2.