Medium severity · published Mar 20, 2026
CVE-2026-33070
FileRise has Unauthenticated Share Link Deletion
4.8
CVSS
0.4%
EPSS
No
On KEV
Description
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FileRise · error311
< 3.8.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33070
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33070
Product
https://github.com/error311/FileRise/releases/tag/v3.8.0
Exploit
https://github.com/error311/FileRise/security/advisories/GHSA-vh5m-w36c-99xv
More from FileRise
9.8
CVE-2026-54414
FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
8.8
CVE-2026-33071
FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
8.2
CVE-2026-61843
FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
8.1
CVE-2026-104108
FileRise OIDC login can bind an attacker identity to an existing local account
8.1
CVE-2026-103977
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts