error311 FileRise 1.4.0 read_own insufficient permissions or privileges

Summaryinfo

A vulnerability identified as critical has been detected in error311 FileRise 1.4.0. Affected by this vulnerability is the function read_own. This manipulation causes insufficient permissions or privileges. This vulnerability is registered as CVE-2025-62510. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in error311 FileRise 1.4.0. It has been declared as critical. Affected by this vulnerability is the function read_own. The manipulation with an unknown input leads to a insufficient permissions or privileges vulnerability. The CWE definition for the vulnerability is CWE-280. The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0, a regression allowed folder visibility/ownership to be inferred from folder names. Low-privilege users could see or interact with folders matching their username and, in some cases, other users’ content. This issue has been patched in version 1.5.0, where it introduces explicit per-folder ACLs (owners/read/write/share/read_own) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-62510 since 10/15/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1222 for this issue.

Upgrading to version 1.5.0 eliminates this vulnerability. Applying the patch b6d86b78967baa2f5a1e191903fc4df13998d87f is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• error311

Name

• FileRise

Version

• 1.4.0

License

• open-source

Website

• Product: https://github.com/error311/FileRise/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion