CVE-2026-92616

FileRise before version 3.28.0 fails to enforce independent, stateless authentication on its WebDAV interface, as required by RFC 4918, and instead lets WebDAV requests inherit privileges from an ambient web application session (CWE-613, insufficient session isolation). A low-privilege authenticated user can send WebDAV requests with their own valid Basic-Auth credentials combined with an active administrator PHPSESSID cookie, causing the WebDAV layer to treat the request as admin-level. The attacker gains unauthorized read and write access to files and folders that should be outside their authorization boundary, though no availability impact is assessed (CVSS 4.0: 7.6 High, AV:N/AC:H/PR:L/UI:N/VC:H/VI:H). Any FileRise deployment running an affected version with both the web UI and the WebDAV interface enabled is affected, with the highest risk where admin and low-privilege sessions can share a browser or where an admin cookie can be injected into requests. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known as of this analysis.

What to do: Upgrade to FileRise 3.28.0 or later, which enforces independent WebDAV authentication. As interim mitigations, do not use the admin web UI and WebDAV from the same browser session, log out of admin sessions after use, and restrict the WebDAV endpoint via reverse-proxy allowlisting or VPN. Check WebDAV access logs for low-privilege accounts performing unexpected reads or writes on admin-owned files.