CVE-2026-54459
- Source
- https://cve.org/CVERecord?id=CVE-2026-54459
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54459.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-54459
- Aliases
-
- GHSA-jp5j-9px9-g47g
- Published
- 2026-10-12T21:55:15Z
- Modified
- 2026-10-14T02:48:26Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- FileRise: Missing CSRF enforcement for file creation and share-link creation
- Details
-
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-352" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54459.json" }- References