error311 FileRise up to 3.22.x Rename Folder renameFolder.php improper authorization

Summaryinfo

A vulnerability marked as critical has been reported in error311 FileRise up to 3.22.x. This affects an unknown part of the file /api/folder/renameFolder.php of the component Rename Folder. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-103988. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in error311 FileRise up to 3.22.x. It has been rated as critical. This issue affects an unknown code of the file /api/folder/renameFolder.php of the component Rename Folder. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the source folder but does not independently authorize a changed destination parent. A qualifying user who owns a source folder can move that tree beneath another user's existing folder or into the root namespace, and the operation rekeys the moved ownership and ACL records to the new path. The destination must be unused and existing victim files cannot be overwritten. Distinct pre-fix errors reveal whether a specifically guessed destination path exists, but disclose no directory listing or file contents. This issue is fixed in version 3.23.0.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-103988 since 10/01/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

By approaching the search of inurl:api/folder/renameFolder.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.23.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• error311

Name

• FileRise

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22

Website

• Product: https://github.com/error311/FileRise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion