Error311 vulnerabilities
38 CVEs and advisories name Error311 as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-104109FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root
- CVE-2026-104107FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs
- CVE-2026-104110FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php
- CVE-2026-104108FileRise OIDC login can bind an attacker identity to an existing local account
- CVE-2026-103977FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
- CVE-2026-104105FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
- CVE-2026-104106FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
- CVE-2026-103988FileRise renameFolder omits destination-parent authorization
- CVE-2026-69193FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
- CVE-2026-69191FileRise: Login Method Restriction Bypass via Direct API Access
- CVE-2026-77427FileRise: Insecure default cryptographic key fallback in manual installs
- CVE-2026-69194FileRise: Unsanitized footerHtml in Public Site Config
- CVE-2026-64856FileRise: Missing Authentication Guard on File Snippet Preview Endpoint
- CVE-2026-62664FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root
- CVE-2026-61844FileRise: Folder Metadata Filename Collisions Bypass "read_own" Isolation
- CVE-2026-61843FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
- CVE-2026-57493FileRise: Remember-me auto-login uses stale admin role from token instead of current role
- CVE-2026-57492FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
- CVE-2026-57490FileRise: WebDAV authentication bypasses TOTP/MFA entirely
- CVE-2026-57491FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist
- CVE-2026-57489FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
- CVE-2026-55498FileRise Shared Folder Symlink Escape
- CVE-2026-54459FileRise: Missing CSRF enforcement for file creation and share-link creation
- CVE-2026-92616FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
- CVE-2026-54414FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
- CVE-2026-44460FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret
- CVE-2026-33477FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content
- CVE-2026-33330FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback
- CVE-2026-33329FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle
- CVE-2026-33072FileRise: Default Encryption Key Enables Token Forgery and Config Decryption