FileRise Insecure Folder Visibility Vulnerability Allowing Unauthorized Access to User Content

A vulnerability in FileRise version 1.4.0 allows low-privilege users to infer folder visibility and ownership based on folder names. Users could see or interact with folders that matched their usernames and, in some instances, access content belonging to other users. This issue arises from incomplete access control checks, which have been addressed in version 1.5.0 by introducing explicit per-folder access control lists and rigorous server-side validations across various file management and WebDAV operations.

Impact

Exploitation of this vulnerability could lead to unauthorized access to user content and interaction with it, based on name-based folder visibility mapping.

Remediation

Users are advised to upgrade to FileRise version 1.5.0, which includes the necessary patches and improvements. Instructions for updating can be found in the FileRise repository.