Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

FileRise preview endpoint can be accessed without login

CVE-2026-64856 · published 4 days ago
Summary

Versions of FileRise earlier than 3.20.0 let anyone call the /api/file/snippet.php preview service without first proving they are logged in. While the system still checks file permissions, an attacker could bypass the quick "not authorized" response and reach the content‑display logic, especially if the server is using unusual proxy headers or has permission settings that are too lax. Upgrade to FileRise 3.20.0 or later, and review proxy and access‑control configurations to ensure only authenticated users can request file previews.

Original advisory text
FileRise: Missing Authentication Guard on File Snippet Preview Endpoint
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-306Missing Authentication for Critical Function
Timeline
Published14 Oct 2026
Updated17 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-64856 · NVD
CVE-2026-64856 · OSV
GHSA-p4c7-8jm2-m88q · GHSA
Track software like this
Free during beta