CVE-2026-25230

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25230", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-30T14:44:47.328Z", "datePublished": "2026-02-09T18:32:09.795Z", "dateUpdated": "2026-02-10T16:01:32.571Z"}, "containers": {"cna": {"title": "FileRise affected by HTML Injection using color property in file tags", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/error311/FileRise/security/advisories/GHSA-h8fw-42v6-gfhv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-h8fw-42v6-gfhv"}, {"name": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/controllers/FileController.php#L4016-L4058", "tags": ["x_refsource_MISC"], "url": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/controllers/FileController.php#L4016-L4058"}, {"name": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/models/FileModel.php#L3146", "tags": ["x_refsource_MISC"], "url": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/models/FileModel.php#L3146"}, {"name": "https://github.com/error311/FileRise/releases/tag/v3.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/error311/FileRise/releases/tag/v3.3.0"}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"version": "< 3.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:33:36.297Z"}, "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0."}], "source": {"advisory": "GHSA-h8fw-42v6-gfhv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:30:28.186509Z", "id": "CVE-2026-25230", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T16:01:32.571Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25230", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T15:30:28.186509Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:30:28.923Z"}}], "cna": {"title": "FileRise affected by HTML Injection using color property in file tags", "source": {"advisory": "GHSA-h8fw-42v6-gfhv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"status": "affected", "version": "< 3.3.0"}]}], "references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-h8fw-42v6-gfhv", "name": "https://github.com/error311/FileRise/security/advisories/GHSA-h8fw-42v6-gfhv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/controllers/FileController.php#L4016-L4058", "name": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/controllers/FileController.php#L4016-L4058", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/models/FileModel.php#L3146", "name": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/models/FileModel.php#L3146", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/error311/FileRise/releases/tag/v3.3.0", "name": "https://github.com/error311/FileRise/releases/tag/v3.3.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T18:33:36.297Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25230", "state": "PUBLISHED", "dateUpdated": "2026-02-10T16:01:32.571Z", "dateReserved": "2026-01-30T14:44:47.328Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-09T18:32:09.795Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FileRise", "vendor": "error311", "versions": [{"status": "affected", "version": "< 3.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*", "matchCriteriaId": "20EF81AB-DD02-41FF-9DCC-6498CF4C595A", "versionEndExcluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0."}, {"lang": "es", "value": "FileRise es un gestor de archivos web / servidor WebDAV autoalojado. Antes de la versi\u00f3n 3.3.0, una vulnerabilidad de inyecci\u00f3n HTML permite a un usuario autenticado modificar el DOM y a\u00f1adir, por ejemplo, elementos de formulario que llaman a ciertos puntos finales o elementos de enlace que redirigen al usuario tras una interacci\u00f3n activa. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 3.3.0."}], "id": "CVE-2026-25230", "lastModified": "2026-06-17T10:24:20.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25230", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:30:28.186509Z", "version": "2.0.3"}}]}, "published": "2026-02-09T20:15:56.700", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/controllers/FileController.php#L4016-L4058"}, {"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/models/FileModel.php#L3146"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/error311/FileRise/releases/tag/v3.3.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-h8fw-42v6-gfhv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.0)"}}], "product": "filerise", "vendor": "error311"}], "analysis": {"en": {"generated_at": "2026-04-18T18:15:35.163983+00:00", "value": {"mitigation_remediation": ["Upgrade FileRise to version 3.3.0 or later to eliminate the HTML injection flaw.", "Restrict or remove authentication credentials of users that do not require access to the file manager, limiting the attack surface for authenticated exploitation.", "Implement strict input validation on the color attribute to allow only hexadecimal color codes and strip any embedded HTML tags, thereby neutralizing injection attempts."], "summary": {"action": "Apply Patch", "impact": "Authenticated DOM-based XSS"}, "threat_synthesis": {"affected_systems": "The issue affects the FileRise self\u2011hosted web file manager / WebDAV server from the error311 vendor. Versions prior to 3.3.0 are vulnerable; version 3.3.0 and later include the fix. The affected product is FileRise from error311.", "description_and_impact": "The vulnerability is an authenticated DOM\u2010based HTML Injection that lets a logged\u2011in user inject arbitrary markup into file tag attributes. This can be used to add form elements that call backend endpoints or create links that redirect users; whether this could lead to privilege escalation or phishing is an inference and not explicitly stated in the vendor's description. The flaw arises from improper handling of the color property and falls under CWE\u2011116 and CWE\u201179. Because it requires authentication, it does not pose a purely remote threat but users can leverage it to move laterally within the application.", "risk_and_exploitability": "The CVSS base score is 4.6, indicating low to moderate severity. The EPSS score is less than 1%, suggesting a very small likelihood of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the application. Once authenticated, they can modify the DOM and potentially trigger calls to internal endpoints or redirect users, which may enable further attacks such as phishing; whether privilege escalation could occur is an inference. Given the low EPSS and lack of known public exploits, the immediate risk is moderate but should still be mitigated promptly."}}}}, "created": "2026-02-10T11:35:18.488080+00:00", "updated": "2026-04-18T18:30:07.270196+00:00", "vendors": ["error311", "error311$PRODUCT$filerise"]}