{"id":"CVE-2026-54459","published":"2026-10-12T22:17:04.780","lastModified":"2026-10-13T14:17:38.493","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cwes":["CWE-352"],"vendors":[],"products":[],"references":[{"url":"https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851","tags":[]},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","tags":[]},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","tags":[]}],"exploitRefs":[{"url":"https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851","tags":[]},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","tags":[]},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","tags":[]}],"hasPoc":true,"ai":null}