{"id":"CVE-2026-54459","revision":"ca546adf3621408bbf9488478066748b","records":[{"revision":"ca546adf3621408bbf9488478066748b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54459","aliases":[],"title":"FileRise: Missing CSRF enforcement for file creation and share-link creation","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.","state":0,"publishedAt":"2026-10-12T21:55:15.872+00:00","modifiedAt":"2026-10-13T13:45:09.011+00:00","affected":[{"ecosystem":"Vendor product","name":"FileRise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"error311\",\n                    \"product\": \"FileRise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.14.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47g","https://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54459","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54459","identifiers":["CVE-2026-54459"]},"retained":false,"historicalAffected":[]}],"coverage":[]}