CVE-2026-54414 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-54414 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-54414 is a path traversal vulnerability in FileRise, a self-hosted file management application, affecting the shared-folder upload endpoint at /api/folder/uploadToSharedFolder.php in versions prior to 3.16.0.

Technical Detail

The flaw exists in insufficient input validation on the upload endpoint, which fails to sanitize directory traversal sequences in user-supplied file path parameters. An unauthenticated or low-privileged attacker can craft a malicious upload request that writes arbitrary files to locations outside the intended upload directory, including sensitive application paths. Successful exploitation can result in arbitrary file write leading to administrator account takeover, for example by overwriting configuration files, credential stores, or injecting a web shell to achieve remote code execution.

Exploitation Status

No known exploit code has been publicly identified at this time, and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. The exploit maturity is assessed as no known exploit as of June 26, 2026. However, the attack surface is straightforward and the vulnerability class is well understood, which lowers the barrier for independent exploit development.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability.

What To Do

Upgrade FileRise to version 3.16.0 or later immediately, as this release contains the vendor's patch for this vulnerability. Given the critical CVSS score of 9.8 and the potential for unauthenticated arbitrary file write and account takeover, patching should be treated as high priority regardless of current exploitation status. If immediate patching is not possible, restrict network access to the FileRise instance, particularly the /api/folder/uploadToSharedFolder.php endpoint, using firewall rules or a reverse proxy with access controls. Monitor web server logs for anomalous POST requests to that endpoint, particularly those containing traversal sequences such as ../ or encoded equivalents. Review the upload directory and surrounding application paths for unexpected or recently modified files as an indicator of prior compromise.