CVE-2026-33329

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33329", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T21:23:36.678Z", "datePublished": "2026-03-24T19:14:42.771Z", "dateUpdated": "2026-03-25T16:20:07.262Z"}, "containers": {"cna": {"title": "FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-73", "lang": "en", "description": "CWE-73: External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh"}, {"name": "https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c", "tags": ["x_refsource_MISC"], "url": "https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c"}, {"name": "https://github.com/error311/FileRise/releases/tag/v3.10.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/error311/FileRise/releases/tag/v3.10.0"}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"version": ">= 1.0.1, < 3.10.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T19:14:42.771Z"}, "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0."}], "source": {"advisory": "GHSA-c2jm-4wp9-5vrh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T16:19:57.166744Z", "id": "CVE-2026-33329", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T16:20:07.262Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33329", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T16:19:57.166744Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T16:20:01.149Z"}}], "cna": {"title": "FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle", "source": {"advisory": "GHSA-c2jm-4wp9-5vrh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"status": "affected", "version": ">= 1.0.1, < 3.10.0"}]}], "references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh", "name": "https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c", "name": "https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/error311/FileRise/releases/tag/v3.10.0", "name": "https://github.com/error311/FileRise/releases/tag/v3.10.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73: External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T19:14:42.771Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33329", "state": "PUBLISHED", "dateUpdated": "2026-03-25T16:20:07.262Z", "dateReserved": "2026-03-18T21:23:36.678Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-24T19:14:42.771Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FileRise", "vendor": "error311", "versions": [{"status": "affected", "version": ">= 1.0.1, < 3.10.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC501FA6-2BC1-4D24-804D-57D7C060159D", "versionEndExcluding": "3.10.0", "versionStartIncluding": "1.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticated user with upload permission can exploit this to write files to arbitrary directories on the server, delete arbitrary directories via the post-assembly cleanup, and probe file/directory existence. This issue has been patched in version 3.10.0."}, {"lang": "es", "value": "FileRise es un gestor de archivos web / servidor WebDAV autoalojado. Desde la versi\u00f3n 1.0.1 hasta antes de la versi\u00f3n 3.10.0, el par\u00e1metro resumableIdentifier en el gestor de carga fragmentada de Resumable.js (UploadModel::handleUpload()) se concatena directamente en las rutas del sistema de archivos sin ninguna sanitizaci\u00f3n. Un usuario autenticado con permiso de carga puede explotar esto para escribir archivos en directorios arbitrarios en el servidor, eliminar directorios arbitrarios a trav\u00e9s de la limpieza posterior al ensamblaje y sondear la existencia de archivos/directorios. Este problema ha sido parcheado en la versi\u00f3n 3.10.0."}], "id": "CVE-2026-33329", "lastModified": "2026-06-17T10:37:19.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33329", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T16:19:57.166744Z", "version": "2.0.3"}}]}, "published": "2026-03-24T20:16:28.217", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/error311/FileRise/commit/3871f9fd1661688bed4f7dd23912be0ebf50973c"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/error311/FileRise/releases/tag/v3.10.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-c2jm-4wp9-5vrh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.1,3.10.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FileRise", "source": "cna", "vendor": "error311"}, "product": "filerise", "vendor": "error311"}], "analysis": {"en": {"generated_at": "2026-03-26T14:58:20.515016+00:00", "value": {"mitigation_remediation": ["Upgrade FileRise to version 3.10.0 or newer."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary file write, directory deletion, and existence detection"}, "threat_synthesis": {"affected_systems": "FileRise, versions from 1.0.1 through any release prior to 3.10.0, are affected. Users deploying the self\u2011hosted web file manager without upgrading past the 3.10.0 release are at risk. The vulnerability exists in the default Resumable.js implementation in the UploadModel::handleUpload() component.", "description_and_impact": "A path traversal flaw in the resumableIdentifier parameter of FileRise\u2019s Resumable.js upload handler allows an authenticated user to craft upload requests that cause the server to write data to any filesystem location, delete arbitrary directories during post\u2011assembly cleanup, and probe for the existence of files or directories. The issue is a classic directory traversal (CWE\u201122) and insecure file handling (CWE\u201173) that can result in significant data loss or corruption and could potentially be leveraged to gain further destructive capabilities within the server environment.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests current exploitation risk is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with upload permission; the attacker must submit a crafted multipart request to the upload endpoint. No elevated privileges are required beyond normal user rights but the impact is confined to the file system of the hosting host."}}}}, "created": "2026-03-25T11:46:20.772982+00:00", "updated": "2026-03-27T09:20:40.286265+00:00", "vendors": ["error311", "error311$PRODUCT$filerise"]}