EUVD-2026-101660

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...

CVE-2026-104109

Prior to version 3.23.0 , the FileRise self-hosted web-based file manager is vulnerable to a flaw where it validates archive entry names but extracts them into the destination before validating resolved paths. An authenticated non-administrator with extract permissions can exploit this by uploadi...

CVE-2026-104109 FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a...

CVE-2026-104107

The web-based file manager FileRise is vulnerable to a path traversal flaw in version 3.22.0 . The /api/file/saveFile.php operation improperly handles dot and dot-dot segments in user-controlled folder inputs before performing ACL inheritance checks. An authenticated non-administrator with a vali...

CVE-2026-104107 FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. Wi...

CVE-2026-104107 FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. Wi...

vuln-chain-lab

File Upload Bypass + Stored XSS PoC Lab A deliberately vulnerable web application demonstrating how a file upload bypass chains with stored XSS to create backdoor admin accounts, even when CSP, CORS, and CSRF protections are in place. Full Blog Post: KurtiseBear Blog This is an educational lab fo...

CVE-2018-0952-SystemCollector

SystemCollector PoC for Privilege Escalation in Windows 10 Diagnostics Hub Standard Collector Service Affected Products Windows 10 Windows Server Windows Server 2016 Visual Studio 2015 Update 3 Visual Studio 2017 Summary The Diagnostics Hub Packaging library, used by Windows Standard Collector...

CVE-2026-104105 FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the targ...

EUVD-2026-101675

Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitrary locations on the scanning filesystem...

CVE-2026-64856

Prior to version 3.20.0 , the self-hosted file manager FileRise is vulnerable due to a missing authenticated-session guard on the /api/file/snippet.php endpoint. This allows unauthenticated requests to bypass the initial session check and reach ACL evaluation instead of receiving an immediate 401...

CVE-2026-64856 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

CVE-2026-64856 FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL...

CVE-2026-61843 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and an...

CVE-2026-61843

Versions of FileRise prior to 3.18.0 are vulnerable to an unauthenticated file overwrite. The software fails to reject destination filenames that already exist within upload-enabled shared folders or upload-only links. An unauthenticated visitor with a valid share token and password can upload a ...

CVE-2026-61843 FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and an...

CVE-2026-54703

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the crossnote.updateMarkdown command in Markdown Preview Enhanced accepts an arbitrary URI and attacker-controlled content, then passes them to vscode.workspace.fs.writeFile without validating that...

CVE-2026-102986

Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/anchor/ requires authentication for write operations but does not verify workspace or project membership. An authenticated user who knows a...

CVE-2026-55498 FileRise Shared Folder Symlink Escape

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An...

CVE-2026-102986

The open-source project management tool Plane (versions 1.3.1 and earlier) contains an authorization bypass in the EntityAssetEndpoint at the /api/public/assets/v2/anchor/{anchor}/ endpoint. While the endpoint requires authentication for write operations, it fails to verify workspace or project m...