CVE-2026-33071

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml, .php5, .htaccess, and other server-side executable types, bypassing the filename validation enforced by the regular upload path. In non-default deployments lacking Apache's LocationMatch protection, this leads to remote code execution. When files are uploaded via WebDAV, the createFile() method in FileRiseDirectory.php and the put() method in FileRiseFile.php accept the filename directly from the WebDAV client without any validation. In contrast, the regular upload endpoint in UploadModel::upload() validates filenames against REGEX_FILE_NAME. This issue is fixed in version 3.8.0.

• CWE-434
• CWE-552

• https://github.com/error311/FileRise/releases/tag/v3.8.0Product, Release Notes
• https://github.com/error311/FileRise/security/advisories/GHSA-46gv-gf5f-wvr2Exploit, Mitigation, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33066SiYuan is a personal knowledge management system. In version…9
• CVE-2026-33067SiYuan is a personal knowledge management system. Versions 3…9
• CVE-2026-33068Claude Code is an agentic coding tool. Versions prior to 2.1…8.8
• CVE-2026-33069PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2026-3307An authorization bypass vulnerability was identified in GitH…2.7
• CVE-2026-33070FileRise is a self-hosted web file manager / WebDAV server. …4.8
• CVE-2026-33072FileRise is a self-hosted web file manager / WebDAV server. …7.5
• CVE-2026-33073Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33074Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33075FastGPT is an AI Agent building platform. In versions 4.14.8…8.8
• CVE-2026-33076Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8
• CVE-2026-33077Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…7.5