CVE-2026-54459— FileRise: Missing CSRF enforcement for file creation and share-link creation
Quick assessment
Affected
error311 FileRise
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FileRise 是一个自托管的基于 Web 的文件管理器，支持多文件上传、编辑和批量操作。在 3.14.0 版本之前，FileRise 对文件创建和共享链接创建的请求进行了身份验证，但未像其他状态更改操作那样强制执行服务器端的 CSRF 令牌检查。 和 这两个 POST 端点调用了 和 ，但未拒绝缺失或无效的 头部。带有已登录用户会话的请求可以创建空文件或创建具有该用户权限的共享链接。不过，默认的 会话 cookie 限制了普通跨站 POST 请求的可达性。该问题已在 3.14.0 版本中得到修复。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54459
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FileRise: Missing CSRF enforcement for file creation and share-link creation
Source: CVE Program / CVE List V5
Vulnerability Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-54459
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54459
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54459 (1)
Vendor Advisories for CVE-2026-54459 (1)
IV. Related Vulnerabilities
Same product: FileRise
-
CVE-2026-92616
FileRise < 3.28.0 Privilege Escalation via WebDAV Session In -
CVE-2026-54414
FileRise shared-folder upload path traversal allows arbitrar -
CVE-2026-44460
FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing -
CVE-2026-33477
FileRise has incorrect authorization in /api/file/snippet.ph -
CVE-2026-33330
FileRise ONLYOFFICE integration allows read-only users to ov
Same vendor: error311
-
CVE-2026-92616
FileRise < 3.28.0 Privilege Escalation via WebDAV Session In -
CVE-2026-54414
FileRise shared-folder upload path traversal allows arbitrar -
CVE-2026-44460
FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing -
CVE-2026-33477
FileRise has incorrect authorization in /api/file/snippet.ph -
CVE-2026-33330
FileRise ONLYOFFICE integration allows read-only users to ov
Same weakness: CWE-352
-
CVE-2022-51020
Flower before 2.2.0 CSRF via Worker and Task Control API End -
CVE-2026-59977
ConvertX: Cross-Site Request Forgery (CSRF) leading to Unaut -
CVE-2026-108479
WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Re -
CVE-2026-108481
WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Re -
CVE-2026-108909
Netcore NR268 CGI Endpoint cross-site request forgery
V. Comments for CVE-2026-54459
No comments yet