CVE-2025-62510
Last modified
CVE-2025-62510 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. EPSS estimates a 0.28% chance of exploitation in the next 30 days.
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their username and, in some cases, other users’ content. This issue has been patched in version 1.5.0, where it introduces explicit per-folder ACLs (owners/read/write/share/read_own) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Filerise | Filerise | < 1.5.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-62510?
How severe is CVE-2025-62510?
How do I fix CVE-2025-62510?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-62505LobeChat is an open source chat application platform. The we…3
- CVE-2025-62506MinIO is a high-performance object storage system. In all ve…8.1
- CVE-2025-62507Redis is an open source, in-memory database that persists on…8.8
- CVE-2025-62508Citizen is a MediaWiki skin that makes extensions part of th…6.5
- CVE-2025-62509FileRise is a self-hosted web-based file manager with multi-…8.1
- CVE-2025-6251The Royal Elementor Addons and Templates plugin for WordPres…6.4
- CVE-2025-62511yt-grabber-tui is a C++ terminal user interface application …6.3
- CVE-2025-62512Piwigo is an open source photo gallery application for the w…5.3
- CVE-2025-62513OpenBao is an open source identity-based secrets management …7.5
- CVE-2025-62514Parsec is a cloud-based application for cryptographically se…7.1
- CVE-2025-62515pyquokka is a framework for making data lakes work for time …9.8
- CVE-2025-62516Rejected reason: Further research determined the issue is no…
Are you affected by CVE-2025-62510?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST