CVE-2026-33070

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.

• CWE-306

• https://github.com/error311/FileRise/releases/tag/v3.8.0Product, Release Notes
• https://github.com/error311/FileRise/security/advisories/GHSA-vh5m-w36c-99xvExploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33065Free5GC is an open-source Linux Foundation project for 5th g…5.3
• CVE-2026-33066SiYuan is a personal knowledge management system. In version…9
• CVE-2026-33067SiYuan is a personal knowledge management system. Versions 3…9
• CVE-2026-33068Claude Code is an agentic coding tool. Versions prior to 2.1…8.8
• CVE-2026-33069PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2026-3307An authorization bypass vulnerability was identified in GitH…2.7
• CVE-2026-33071FileRise is a self-hosted web file manager / WebDAV server. …8.8
• CVE-2026-33072FileRise is a self-hosted web file manager / WebDAV server. …7.5
• CVE-2026-33073Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33074Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33075FastGPT is an AI Agent building platform. In versions 4.14.8…8.8
• CVE-2026-33076Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8