Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version 1.4.0, a business logic flaw in FileRise’s file/folder handling allows low-privilege users to perform unauthorized operations (view/delete/modify) on files created by other users. The root cause was inferring ownership/visibility from folder names (e.g., a folder named after a username) and missing server-side authorization/ownership checks across file operation endpoints. This amounted to an IDOR pattern: an attacker could operate on resources identified only by predictable names. This issue has been patched in version 1.4.0 and further hardened in version 1.5.0. A workaround for this issue involves restricting non-admin users to read-only or disable delete/rename APIs server-side, avoid creating top-level folders named after other usernames, and adding server-side checks that verify ownership before delete/rename/move.
INFO
Published Date :
2025-10-20T17:38:49.999Z
Last Modified :
2025-10-20T18:05:53.350Z
Source :
GitHub_M
AFFECTED PRODUCTS
The following products are affected by CVE-2025-62509 vulnerability.
| Vendors | Products |
|---|---|
| Filerise |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-62509.
