{"id":"CVE-2026-55498","revision":"edb754b81cdb49babf503c736a08fc9d","records":[{"revision":"edb754b81cdb49babf503c736a08fc9d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-55498","aliases":[],"title":"FileRise Shared Folder Symlink Escape","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared folder to a sibling directory under the upload root. An unauthenticated holder of a valid share token can use shared-folder listing, direct download, or ZIP creation to access files outside the folder that was actually shared. The flaw occurs because the affected shared-folder paths resolve symlinks without enforcing the original shared folder as the real-path boundary. This issue is fixed in version 3.15.0.","state":0,"publishedAt":"2026-10-14T19:57:05.711+00:00","modifiedAt":"2026-10-15T15:28:30.57+00:00","affected":[{"ecosystem":"Vendor product","name":"FileRise","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"error311\",\n                    \"product\": \"FileRise\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.15.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","score":4.8,"severity":"MEDIUM"}],"references":["https://github.com/error311/FileRise/security/advisories/GHSA-83rw-5ffw-p798","https://github.com/error311/FileRise/commit/f24af3f2a25cec092d19de93acbc215e74659a22","https://github.com/error311/FileRise/releases/tag/v3.15.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-55498","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-55498","identifiers":["CVE-2026-55498"]},"retained":false,"historicalAffected":[]}],"coverage":[]}