CVE-2026-64856

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.

• CWE-200
• CWE-306

• https://github.com/error311/FileRise/commit/8c0875bf8f7fd5c6769f4159b999bf08a9d4f0c9
• https://github.com/error311/FileRise/releases/tag/v3.20.0
• https://github.com/error311/FileRise/security/advisories/GHSA-p4c7-8jm2-m88q

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64847AnyIO is a high level asynchronous concurrency and networkin…6.8
• CVE-2026-64849MLflow is an open source AI engineering platform for agents,…9.3
• CVE-2026-6485UEFI BIOS embedded Shell could be used to bypass Secure Boot…8.2
• CVE-2026-64850Grav is a file-based Web platform. Prior to 2.0.7, Grav Blue…8.7
• CVE-2026-64851Grav Shortcode Core Plugin allows for the development shortc…8.5
• CVE-2026-64852Grav API Plugin is a RESTful API for Grav CMS that provides …8.7
• CVE-2026-64857tirreno, a security framework, has a session fixation issue …5.3
• CVE-2026-64859New API is a large language mode (LLM) gateway and artificia…9.1
• CVE-2026-6486A vulnerability was detected in classroombookings up to 2.17…3.5
• CVE-2026-64860ESP-Protocols is a collection of protocol components for ESP…6.5
• CVE-2026-64862Frappe HR is an open-source human resources management solut…6.5
• CVE-2026-64863goshs is a feature-rich single-binary file server for red te…9.1