CVE-2026-104108
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch…
- Risk score
- 55/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtai…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.23.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
- Remotely exploitable without logging in
References
Original description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.
Last activity 14 Oct 2026. Patch Forecast updates every hour.