Medium severity · published Feb 9, 2026
CVE-2026-25230
FileRise affected by HTML Injection using color property in file tags
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
FileRise is a self-hosted web file manager / WebDAV server. Prior to 3.3.0, an HTML Injection vulnerability allows an authenticated user to modify the DOM and add e.g. form elements that call certain endpoints or link elements that redirect the user on active interaction. This vulnerability is fixed in 3.3.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FileRise · error311
< 3.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25230
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25230
Product
https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/controllers/FileController.php#L4016-L4058
Product
https://github.com/error311/FileRise/blob/7fee135a5b8feb25558aba0474bd6bb53943fc88/src/models/FileModel.php#L3146
Release Notes
https://github.com/error311/FileRise/releases/tag/v3.3.0
Exploit
https://github.com/error311/FileRise/security/advisories/GHSA-h8fw-42v6-gfhv
More from FileRise
9.8
CVE-2026-54414
FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
8.8
CVE-2026-33071
FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
8.2
CVE-2026-61843
FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
8.1
CVE-2026-104108
FileRise OIDC login can bind an attacker identity to an existing local account
8.1
CVE-2026-103977
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts