CVE-2026-103988

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not...

CVE-2026-103988

Prior to version 3.23.0 , the FileRise web-based file manager is vulnerable to an authorization bypass in the /api/folder/renameFolder.php endpoint. While the system validates the source folder, it fails to independently authorize the destination parent. An authenticated, non-administrator user w...