CVE-2026-92616 FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
Authenticated low-privilege users can gain admin access by exploiting session inheritance flaws in the WebDAV interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92616?
CVE-2026-92616 is a high-severity vulnerability in error311 FileRise, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries, as the WebDAV layer incorrectly inherits elevated privileges from an ambient web session rather than enforcing independent stateless authentication per RFC 4918.
Weakness: CWE-613
Which versions are affected by CVE-2026-92616?
How do I fix CVE-2026-92616?
No fix has been published for CVE-2026-92616 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92616 being exploited?
There is no known exploitation of CVE-2026-92616 in the wild and no public exploit code.
Sources
Also known as GHSA-57x9-hhc6-cx9h.