CVE-2026-57491

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise archive extraction does not apply UploadNamePolicy::isAllowedForWrite() before ZipArchive::extractTo() writes entries into the destination directory. An authenticated user with upload and extract permissions can place a blocked extension such as a PHP-family file inside a ZIP and cause it to be written to disk even when normal uploads reject that filename. Post-extraction metadata pruning does not remove the blocked file, so deployments that execute uploaded content may permit code execution. This issue is fixed in version 3.16.0.

• CWE-434

• https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6
• https://github.com/error311/FileRise/releases/tag/v3.16.0
• https://github.com/error311/FileRise/security/advisories/GHSA-c4g2-8fg6-5xrr
• https://github.com/error311/FileRise/security/advisories/GHSA-c4g2-8fg6-5xrr

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57486pupnp is an SDK for development of UPnP device and control p…7.5
• CVE-2026-57487pupnp is an SDK for development of UPnP device and control p…7.5
• CVE-2026-57488pupnp is an SDK for development of UPnP device and control p…7.1
• CVE-2026-57489FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-5749Inadequate access control in the registration process in Ful…8.7
• CVE-2026-57490FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-57492FileRise is a self-hosted web-based file manager with multi-…7.4
• CVE-2026-57493FileRise is a self-hosted web-based file manager with multi-…6.8
• CVE-2026-57494AgenticMail gives AI agents real email addresses and phone n…7.1
• CVE-2026-57495AgenticMail gives AI agents real email addresses and phone n…8.2
• CVE-2026-57496NetLicensing MCP Server is a natural-language interface that…9.6
• CVE-2026-57497webtransport-go is an implementation of the WebTransport pro…5.3