CVE-2026-55498

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared. The flaw occurs because the affected shared-folder paths resolve symlinks without enforcing the original shared folder as the real-path boundary. This issue is fixed in version 3.15.0.

• CWE-59

• https://github.com/error311/FileRise/commit/f24af3f2a25cec092d19de93acbc215e74659a22
• https://github.com/error311/FileRise/releases/tag/v3.15.0
• https://github.com/error311/FileRise/security/advisories/GHSA-83rw-5ffw-p798
• https://github.com/error311/FileRise/security/advisories/GHSA-83rw-5ffw-p798

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55491BigBlueButton is an open-source virtual classroom. Prior to …5.4
• CVE-2026-55493HotCRP is conference review software. Starting with 2.101, t…6.5
• CVE-2026-55494Tugtainer is a self-hosted app for automating updates of Doc…9.8
• CVE-2026-55495Cloudreve is a self-hosted file management and sharing syste…4.3
• CVE-2026-55496Cloudreve is a self-hosted file management and sharing syste…4.3
• CVE-2026-55497Cloudreve is a self-hosted file management and sharing syste…6.5
• CVE-2026-55499Cloudreve is a self-hosted file management and sharing syste…4.3
• CVE-2026-5550A vulnerability was identified in Tenda AC10 16.03.10.10_mul…8.8
• CVE-2026-555009Router is an AI router & token saver. Prior to 0.4.80, the …9.9
• CVE-2026-555019Router is an AI router & token saver. Prior to 0.4.80, the …7.3
• CVE-2026-55502Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-55509WsgiDAV is a generic and extendable WebDAV server based on W…8.8