← Back

CVE-2026-33070

nvd nist
Published: Mar 20, 2026Modified: Jun 17, 2026

JSON object

Loading...
4.8
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Exploitability: 2.2 / Impact: 2.5
Source: NVD

Description

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.

Affected (1)

Products: Filerise: Filerise
Filerise
1 product
Filerise
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Filerise
Before 3.8.0

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: security-advisories@github.com
ProductRelease Notes
Source: security-advisories@github.com
ExploitMitigationVendor Advisory

Timeline

No history available yet.