CVE-2026-54414

{"id": "CVE-2026-54414", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54414", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T15:04:58.077602Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"repo": "https://github.com/error311/FileRise", "vendor": "error311", "product": "FileRise", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.16.0"}], "programFiles": ["src/FileRise/Domain/UploadModel.php", "src/FileRise/Support/UploadNamePolicy.php", "src/FileRise/Http/Controllers/FolderController.php"], "collectionURL": "https://github.com/error311/FileRise", "defaultStatus": "unaffected"}]}], "published": "2026-06-19T06:17:09.830", "references": [{"url": "https://github.com/error311/FileRise", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/error311/FileRise/blob/v3.15.0/src/FileRise/Domain/UploadModel.php#L1023", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}, {"url": "https://github.com/error311/FileRise/releases/tag/v3.16.0", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "FileRise before 3.16.0 is vulnerable to path traversal in the shared-folder upload endpoint (/api/folder/uploadToSharedFolder.php), leading to arbitrary file write and administrator account takeover. The upload filename is validated by FolderController with basename and REGEX_FILE_NAME, which permit URL-encoded sequences (the regex blocks / and \\ but not %)."}, {"lang": "es", "value": "FileRise anterior a la versi\u00f3n 3.16.0 es vulnerable a salto de ruta en el endpoint de carga de carpetas compartidas (/API/folder/uploadToSharedFolder.PHP), lo que lleva a la escritura arbitraria de archivos y a la toma de control de la cuenta de administrador. El nombre de archivo de carga es validado por FolderController con basename() y REGEX_FILE_NAME, que permiten secuencias codificadas en URL (la expresi\u00f3n regular bloquea / y \\ pero no %). El nombre de archivo sin procesar se pasa luego a UploadModel::handleUpload, donde se reconstruye como trim(urldecode(basename($fileName))), reintroduciendo separadores de ruta despu\u00e9s de la validaci\u00f3n (por ejemplo, ..%2fusers%2fusers.txt se convierte en .. / users/users.txt). UploadNamePolicy::isAllowedForWrite() aplica basename() internamente y por lo tanto solo eval\u00faa el componente final (users.txt), permitiendo que la secuencia de salto de ruta pase la pol\u00edtica de extensi\u00f3n. La ruta de destino se utiliza luego directamente en move_uploaded_file() sin una verificaci\u00f3n de contenci\u00f3n de realpath, permitiendo una escritura fuera del directorio de carga previsto. Un atacante que posee un enlace/token de carpeta compartida v\u00e1lido, no caducado y habilitado para carga (los cuales est\u00e1n dise\u00f1ados para ser compartidos p\u00fablicamente) puede sobrescribir users/users.txt para crear una cuenta de administrador, lo que resulta en una toma de control de administrador no autenticada y, dependiendo de la configuraci\u00f3n, ejecuci\u00f3n remota de c\u00f3digo. La explotaci\u00f3n requiere la posesi\u00f3n de un enlace/token de carpeta compartida v\u00e1lido, no caducado y habilitado para carga. Este problema se corrige en la versi\u00f3n 3.16.0, que decodifica la URL antes de la validaci\u00f3n y rechaza cualquier separador de ruta en el nombre de archivo de carga."}], "lastModified": "2026-10-26T11:10:00.157", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}