CVE-2025-68116

FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site Scripting (XSS) due to unsafe handling of browser-renderable user uploads when served through the sharing and download endpoints. An attacker who can get a crafted SVG (primary) or HTML (secondary) file stored in a FileRise instance can cause JavaScript execution when a victim opens a generated share link (and in some cases via the direct download endpoint). This impacts share links (`/api/file/share.php`) and direct file access / download path (`/api/file/download.php`), depending on browser/content-type behavior. Version 2.7.1 fixes the issue.

• CWE-79

• https://github.com/error311/FileRise/security/advisories/GHSA-35pp-ggh6-c59cExploit, Third Party Advisory

Published

Dec 16, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68110ChurchCRM is an open-source church management system. Versio…8.8
• CVE-2025-68111ChurchCRM is an open-source church management system. In ver…7.2
• CVE-2025-68112ChurchCRM is an open-source church management system. In ver…8.8
• CVE-2025-68113ALTCHA is privacy-first software for captcha and bot protect…6.5
• CVE-2025-68114Capstone is a disassembly framework. In versions 6.0.0-Alpha…9.8
• CVE-2025-68115Parse Server is an open source backend that can be deployed …6.1
• CVE-2025-68118FreeRDP is a free implementation of the Remote Desktop Proto…9.1
• CVE-2025-68119Downloading and building modules with malicious version stri…7
• CVE-2025-68120To prevent unexpected untrusted code execution, the Visual S…5.4
• CVE-2025-68121During session resumption in crypto/tls, if the underlying C…10
• CVE-2025-68124Rejected reason: reserved but not needed
• CVE-2025-68125Rejected reason: reserved but not needed