CVE-2026-54459

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.

• CWE-352

• https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851
• https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g
• https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g

Published

Oct 12, 2026

Last Modified

Oct 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54452safeurl is a server-side request forgery protection library.…6.3
• CVE-2026-54453OpenCATS is an open-source applicant tracking system and rec…7.2
• CVE-2026-54454OpenCATS is an open-source applicant tracking system and rec…9.1
• CVE-2026-54455OpenCATS is an open-source applicant tracking system and rec…7.6
• CVE-2026-54457TensorZero is an open-source LLMOps platform that unifies an…7.7
• CVE-2026-54458WWBN AVideo is an open source video platform. Versions prior…9.6
• CVE-2026-5446In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS …7.1
• CVE-2026-54460OpenReception's appointment booking software provides an end…9.8
• CVE-2026-54461Habitica is a habit tracker application that treats goals li…6.5
• CVE-2026-54462Knative pkg provides common packages shared across Knative r…6.5
• CVE-2026-54463websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54464### Impact If this library is used in tandem with the `perm…6.3