CVE-2026-54414 – Path Traversal Leads to Admin Takeover and RCE in FileRise before 3.16.0

Summary

CVE-2026-54414 is a critical path traversal vulnerability in FileRise, a self-hosted PHP-based web file manager, affecting all versions prior to 3.16.0. The flaw resides in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php) and enables an attacker in possession of a valid shared-folder upload link — tokens explicitly designed to be distributed publicly to clients — to write arbitrary files outside the intended upload directory, overwrite the user database, inject a new administrator account, and potentially achieve remote code execution. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical).

Technical details

• Root cause: Filename validation is performed before URL-decoding. The FolderController validates the uploaded filename using basename() and a regex that blocks literal / and “ characters but does not block the % character, allowing URL-encoded path separators (e.g., ..%2fusers%2fusers.txt) to pass validation untouched.
• Decode-after-validate flaw: The raw filename is then passed to UploadModel::handleUpload, where it is reconstructed via trim(urldecode(basename($fileName))). This step reintroduces path separators after validation has already completed — for example, ..%2fusers%2fusers.txt becomes ../users/users.txt.
• Insufficient write policy: UploadNamePolicy::isAllowedForWrite() applies basename() internally and therefore evaluates only the final filename component (e.g., users.txt), not the full traversal path. The extension policy is bypassed entirely.
• No path containment: The resulting destination path is passed directly to move_uploaded_file() with no realpath() containment check, allowing writes to arbitrary locations on the filesystem.
• Exploit path: An attacker can overwrite users/users.txt to inject a new administrator account, achieving unauthenticated admin takeover. Depending on server configuration, this can be escalated to remote code execution.
• Attack vector: Fully remote, over HTTP/HTTPS to the vulnerable endpoint. No user interaction required.
• Prerequisite: A valid, non-expired, upload-enabled shared-folder token. Per the CVE record, these tokens are designed to be shared publicly with external clients and customers, making the effective authentication bar extremely low.

Affected software

• FileRise (by error311): all versions prior to 3.16.0

Severity

CVSS v3.1 base score: 9.8 (Critical)
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

• Immediate: Upgrade to FileRise 3.16.0 (released June 17, 2026). This version URL-decodes filenames before validation and explicitly rejects any path separators in the upload filename, fully remediating the traversal flaw.
• If immediate patching is not feasible: Restrict network or web server access to the /api/folder/uploadToSharedFolder.php endpoint, and suspend issuance of shared-folder upload links until the patch is applied.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-54414 at NIST
• FileRise v3.16.0 Release (Vendor Fix)