# cve.now: Error311

The newest entries naming Error311 as an affected vendor (up to 200), of 38 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-104109](https://cve.now/CVE-2026-104109.md): FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root (CVSS 6.8)
- [CVE-2026-104107](https://cve.now/CVE-2026-104107.md): FileRise: Authenticated path traversal escapes configured storage root through inherited ACLs (CVSS 6.5)
- [CVE-2026-104110](https://cve.now/CVE-2026-104110.md): FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php (CVSS 5.3)
- [CVE-2026-104108](https://cve.now/CVE-2026-104108.md): FileRise OIDC login can bind an attacker identity to an existing local account (CVSS 8.1)
- [CVE-2026-103977](https://cve.now/CVE-2026-103977.md): FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts (CVSS 8.1)
- [CVE-2026-104105](https://cve.now/CVE-2026-104105.md): FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay) (CVSS 6.4)
- [CVE-2026-104106](https://cve.now/CVE-2026-104106.md): FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification (CVSS 6.5)
- [CVE-2026-103988](https://cve.now/CVE-2026-103988.md): FileRise renameFolder omits destination-parent authorization (CVSS 5.4)
- [CVE-2026-69193](https://cve.now/CVE-2026-69193.md): FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying (CVSS 6.5)
- [CVE-2026-69191](https://cve.now/CVE-2026-69191.md): FileRise: Login Method Restriction Bypass via Direct API Access (CVSS 5.4)
- [CVE-2026-77427](https://cve.now/CVE-2026-77427.md): FileRise: Insecure default cryptographic key fallback in manual installs (CVSS 5.9)
- [CVE-2026-69194](https://cve.now/CVE-2026-69194.md): FileRise: Unsanitized footerHtml in Public Site Config (CVSS 4.8)
- [CVE-2026-64856](https://cve.now/CVE-2026-64856.md): FileRise: Missing Authentication Guard on File Snippet Preview Endpoint (CVSS 3.7)
- [CVE-2026-62664](https://cve.now/CVE-2026-62664.md): FileRise: Authenticated path traversal in createFolder allows arbitrary directory creation outside the upload root (CVSS 5.4)
- [CVE-2026-61844](https://cve.now/CVE-2026-61844.md): FileRise: Folder Metadata Filename Collisions Bypass "read\_own" Isolation (CVSS 7.1)
- [CVE-2026-61843](https://cve.now/CVE-2026-61843.md): FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares (CVSS 8.2)
- [CVE-2026-57493](https://cve.now/CVE-2026-57493.md): FileRise: Remember-me auto-login uses stale admin role from token instead of current role (CVSS 6.8)
- [CVE-2026-57492](https://cve.now/CVE-2026-57492.md): FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation (CVSS 7.4)
- [CVE-2026-57490](https://cve.now/CVE-2026-57490.md): FileRise: WebDAV authentication bypasses TOTP/MFA entirely (CVSS 8.1)
- [CVE-2026-57491](https://cve.now/CVE-2026-57491.md): FileRise: ZIP extraction writes blocked file extensions to disk, bypassing the upload blocklist (CVSS 6.5)
- [CVE-2026-57489](https://cve.now/CVE-2026-57489.md): FileRise: AUTH\_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass (CVSS 8.1)
- [CVE-2026-55498](https://cve.now/CVE-2026-55498.md): FileRise Shared Folder Symlink Escape (CVSS 4.8)
- [CVE-2026-54459](https://cve.now/CVE-2026-54459.md): FileRise: Missing CSRF enforcement for file creation and share-link creation (CVSS 4.3)
- [CVE-2026-92616](https://cve.now/CVE-2026-92616.md): FileRise \< 3.28.0 Privilege Escalation via WebDAV Session Inheritance (CVSS 7.6)
- [CVE-2026-54414](https://cve.now/CVE-2026-54414.md): FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover (CVSS 9.8)
- [CVE-2026-44460](https://cve.now/CVE-2026-44460.md): FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret (CVSS 7.4)
- [CVE-2026-33477](https://cve.now/CVE-2026-33477.md): FileRise has incorrect authorization in /api/file/snippet.php allows read\_own users to read other users’ file content (CVSS 4.3)
- [CVE-2026-33330](https://cve.now/CVE-2026-33330.md): FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback (CVSS 7.1)
- [CVE-2026-33329](https://cve.now/CVE-2026-33329.md): FileRise: Path Traversal in \`resumableIdentifier\` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle (CVSS 8.1)
- [CVE-2026-33072](https://cve.now/CVE-2026-33072.md): FileRise: Default Encryption Key Enables Token Forgery and Config Decryption (CVSS 8.2)
- [CVE-2026-33071](https://cve.now/CVE-2026-33071.md): FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads (CVSS 4.3)
- [CVE-2026-33070](https://cve.now/CVE-2026-33070.md): FileRise has Unauthenticated Share Link Deletion (CVSS 3.7)
- [CVE-2026-25231](https://cve.now/CVE-2026-25231.md): FileRise affected by an Unauthenticated File Read Due to Insufficient Access Control (CVSS 7.5)
- [CVE-2026-25230](https://cve.now/CVE-2026-25230.md): FileRise affected by HTML Injection using color property in file tags (CVSS 4.6)
- [CVE-2025-68116](https://cve.now/CVE-2025-68116.md): FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling (CVSS 8.9)
- [CVE-2025-66403](https://cve.now/CVE-2025-66403.md): FileRise Vulnerable to Stored XSS via SVG Upload (CVSS 4.6)
- [CVE-2025-62510](https://cve.now/CVE-2025-62510.md): FileRise insecure folder visibility via name-based mapping and incomplete ACL checks (CVSS 8.1)
- [CVE-2025-62509](https://cve.now/CVE-2025-62509.md): FileRise improper ownership/permission validation allowed cross-tenant file operations (CVSS 8.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/error311
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.