6 matches found
CVE-2026-104110
Unauthenticated information disclosure in FileRise Pro portal endpoint get.php Summary public/api/pro/portals/get.php returns the full internal record of a FileRise Pro client portal — including its internal storage folder path, the client's contact email, and its complete upload policy — to any...
CVE-2026-104110
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug. The response...
CVE-2026-104110
Prior to version 3.24.0 , the FileRise Pro add-on was vulnerable to unauthenticated information disclosure via the /api/pro/portals/get.php endpoint. The root cause was a missing authentication gate (fr_pro_guard_auth()), allowing any caller who guessed a portal slug to retrieve a full internal r...
CVE-2026-104110 FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/pro/portals/get.php returns a configured client portal's full internal record to an unauthenticated caller who knows or guesses the portal slug. The response...
PT-2026-104431
Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.24.0 Description An information leak exists in the Pro add-on when at least one portal is configured. An unauthenticated user can retrieve the full internal record of a configured client portal by providing the...
