FileRise provides security fixes for the latest minor release line only.

If you’re on an older minor line, please upgrade to the latest release to receive security fixes.

Please do not open a public issue. Use one of the private channels below:

1. GitHub Security Advisory (preferred)
   Open a private report here: https://github.com/error311/FileRise/security/advisories/new

2. Email
   Send details to security@filerise.net with subject: [FileRise] Security Vulnerability Report.

• Affected versions, component/endpoint, and impact
• Reproduction steps / PoC
• Any logs, screenshots, or crash traces
• Safe test scope used (see below)

If you’d like encrypted comms, ask for our PGP key in your first email.

• Acknowledgement: within 48 hours
• Triage & initial assessment: within 7 days
• Fix target: within 30 days for high-severity issues (may vary by complexity)
• CVE & advisory: we publish a GitHub Security Advisory and request a CVE when appropriate.
  We aim to notify the reporter before public disclosure and credit them (unless they prefer to remain anonymous).

We support good-faith research. Please:

• Avoid privacy violations, data exfiltration, and service disruption (no DoS, spam, or brute-forcing)
• Don’t access other users’ data beyond what’s necessary to demonstrate the issue
• Don’t run automated scans against production installs you don’t own
• Follow applicable laws and make a good-faith effort to respect data and availability

If you follow these guidelines, we won’t pursue or support legal action.

• GHSA-hv99-77cw-hvpr - <= 3.2.3: Unauthenticated File Read Due to Insufficient Access Control Fixed in: 3.3.0 and later. Thanks to Marcel Graf (AWARE7 GmbH) @ByteTyson for responsible disclosure and verification of the fix.

• GHSA-h8fw-42v6-gfhv - <= 3.2.3: HTML Injection using color property in file tags Fixed in: 3.3.0 and later. Thanks to Marcel Graf (AWARE7 GmbH) @ByteTyson for responsible disclosure and verification of the fix.

• GHSA-35pp-ggh6-c59c — < 2.7.1: Stored XSS via browser-rendered user uploads (SVG primary; HTML rendering via share links also documented).
  Fixed in: 2.7.1. Thanks to @x0root for responsible disclosure.
  Note: Related reports covering the same root cause and affected endpoint(s) were consolidated into this advisory to avoid duplicate tracking/CVEs.

• GHSA-6p87-q9rh-95wh — ≤ 1.3.15: Improper ownership/permission validation allowed cross-tenant file operations.
  Fixed in: 1.5.0 and later.

• GHSA-jm96-2w52-5qjj — v1.4.0: Insecure folder visibility via name-based mapping and incomplete ACL checks.
  Fixed in: 1.5.0 and later.

• GHSA-vh5m-w36c-99xv / CVE-2026-33070 — < 3.8.0: Unauthenticated Share Link Deletion.
  Fixed in: 3.8.0 and later. Thanks to n0rv-TvT for responsible disclosure.

• GHSA-46gv-gf5f-wvr2 / CVE-2026-33071 — < 3.8.0: WebDAV upload path bypasses filename validation enforced by regular uploads.
  Fixed in: 3.8.0 and later. Thanks to n0rv-TvT for responsible disclosure.

• GHSA-f4xx-57cv-mg3x / CVE-2026-33072 — < 3.9.0: Default Encryption Key Enables Token Forgery and Config Decryption.
  Fixed in: 3.9.0 and later. Thanks to n0rv-TvT for responsible disclosure.

• GHSA-c2jm-4wp9-5vrh / CVE-2026-33329 — < 3.10.0: Path Traversal in resumableIdentifier Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle.
  Fixed in: 3.10.0 and later. Thanks to kq5y for responsible disclosure.

• GHSA-6c3j-f4x4-36m3 / CVE-2026-33330 — < 3.10.0: FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback.
  Fixed in: 3.10.0 and later. Thanks to bg0d-glitch for responsible disclosure.

• GHSA-62wx-vp78-2p83 / CVE-2026-33477 - < 3.11.0: Incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content Fixed in: 3.11.0 and later. Thanks to bg0d-glitch for responsible disclosure.

Thanks to @kiwi865, @ByteTyson, @x0root, n0rv-TvT, kq5y, and bg0d-glitch for responsible disclosure of issues.

General security questions: admin@filerise.net