Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-57491— FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist

Quick assessment

Affected

error311 FileRise

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FileRise 是一款自托管的基于 Web 的文件管理器，支持多文件上传、编辑和批量操作。在 3.16.0 版本之前，FileRise 在进行归档解压缩时，在调用将条目写入目标目录之前，未应用策略。因此，拥有上传和解压缩权限的已认证用户可以将受限制的扩展名（例如 PHP 系列文件）放入 ZIP 归档中，即使正常上传流程会拒绝该文件名，这些文件仍可能被写入磁盘。解压缩后的元数据清理过程不会移除该受限制的文件，因此，如果部署环境执行上传的内容，可能导致代码执行。此问题已在 3.16.0 版本中修复。

CVSS 6.5 · Medium Updated Oct 15, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1505.003 · Web Shell

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist

Source: CVE Program / CVE List V5

Vulnerability Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename. Post-extraction metadata pruning does not remove the blocked file, so deployments that execute uploaded content may permit code execution. This issue is fixed in version 3.16.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

危险类型文件的不加限制上传

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
error311	FileRise	< 3.16.0	-

II. Public POCs for CVE-2026-57491

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-57491

请登录查看更多情报信息。

Other References for CVE-2026-57491 (2)

🔗 Release v3.16.0 · error311/FileRise · GitHub x_refsource_MISC
ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist · Advisory · error311/FileRise · GitHub x_refsource_CONFIRM

https://www.cve.org/CVERecord?id=CVE-2026-57491

Same Patch Batch · error311 · 2026-10-14 · 22 CVEs total

CVE-2026-61843	8.2 HIGH	FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
CVE-2026-57489	8.1 HIGH	FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full
CVE-2026-57490	8.1 HIGH	FileRise: WebDAV authentication bypasses TOTP/MFA entirely
CVE-2026-103977	8.1 HIGH	FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
CVE-2026-104108	8.1 HIGH	FileRise OIDC login can bind an attacker identity to an existing local account
CVE-2026-57492	7.4 HIGH	FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated a
CVE-2026-61844	7.1 HIGH	FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
CVE-2026-104109	6.8 MEDIUM	FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files ou
CVE-2026-57493	6.8 MEDIUM	FileRise: Remember-me auto-login uses stale admin role from token instead of current role
CVE-2026-104107	6.5 MEDIUM	FileRise: Authenticated path traversal escapes configured storage root through inherited A
CVE-2026-104106	6.5 MEDIUM	FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activ
CVE-2026-69193	6.5 MEDIUM	FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
CVE-2026-104105	6.4 MEDIUM	FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its wi
CVE-2026-77427	5.9 MEDIUM	FileRise: Insecure default cryptographic key fallback in manual installs
CVE-2026-103988	5.4 MEDIUM	FileRise renameFolder omits destination-parent authorization
CVE-2026-69191	5.4 MEDIUM	FileRise: Login Method Restriction Bypass via Direct API Access
CVE-2026-62664	5.4 MEDIUM	FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation
CVE-2026-104110	5.3 MEDIUM	FileRise: Unauthenticated disclosure of internal folder path, client email, and upload pol
CVE-2026-69194	4.8 MEDIUM	FileRise: Unsanitized footerHtml in Public Site Config
CVE-2026-55498	4.8 MEDIUM	FileRise Shared Folder Symlink Escape

Showing top 20 of 22 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: FileRise

Same vendor: error311

Same weakness: CWE-434

V. Comments for CVE-2026-57491

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-57491— FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist

Quick assessment

Possible ATT&CK Techniques 2 AI

I. Basic Information for CVE-2026-57491

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-57491

III. Intelligence Information for CVE-2026-57491

Other References for CVE-2026-57491 (2)

Same Patch Batch · error311 · 2026-10-14 · 22 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-57491

Leave a comment