High severity · published Oct 20, 2025
CVE-2025-62510
FileRise insecure folder visibility via name-based mapping and incomplete ACL checks
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their username and, in some cases, other users’ content. This issue has been patched in version 1.5.0, where it introduces explicit per-folder ACLs (owners/read/write/share/read_own) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FileRise · error311
= 1.4.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62510
Patch
https://github.com/error311/FileRise/commit/b6d86b78967baa2f5a1e191903fc4df13998d87f
Issue Tracking
https://github.com/error311/FileRise/issues/55
Vendor Advisory
https://github.com/error311/FileRise/security/advisories/GHSA-jm96-2w52-5qjj
More from FileRise
9.8
CVE-2026-54414
FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
8.8
CVE-2026-33071
FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
8.2
CVE-2026-61843
FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
8.1
CVE-2026-104108
FileRise OIDC login can bind an attacker identity to an existing local account
8.1
CVE-2026-103977
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts