Loading story…
Two high-severity vulnerabilities in the self-hosted web file manager and WebDAV server FileRise exposed organizations to serious compromise. CVE-2026-33072 affects versions before 3.9.0 and stems from a hardcoded default value for PERSISTENT_TOKENS_KEY, which was reused for HMAC token generation, AES configuration encryption, and session-related functions. An unauthenticated attacker could use the shared key to forge upload tokens for arbitrary file uploads to shared folders and decrypt sensitive administrator configuration data, including OIDC client secrets and SMTP passwords.
A second flaw, CVE-2026-33329, affects FileRise versions 1.0.1 through before 3.10.0 and allows path traversal through the resumableIdentifier parameter in the Resumable.js chunked upload handler. An authenticated user with upload permission could write files to arbitrary server directories, trigger recursive deletion of arbitrary directories during cleanup, and use the behavior as a limited file or directory existence oracle. FileRise addressed the issues in versions 3.9.0 and 3.10.0, respectively, underscoring the need for administrators to upgrade promptly and review exposed secrets and file integrity.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-33329 was newly recorded on March 24, 2026, as a FileRise vulnerability involving unsanitized filesystem path construction from resumableIdentifier. The issue was classified under CWE-22 and CWE-73.
FileRise fixed CVE-2026-33329 in version 3.10.0, resolving a path traversal issue in the resumableIdentifier parameter of the Resumable.js upload handler. The flaw affected versions 1.0.1 through before 3.10.0 and could allow arbitrary file write, recursive directory deletion, and limited existence probing by an authenticated uploader.
The vulnerability CVE-2026-33072 was publicly documented as affecting FileRise, with details showing the shared default key was used for HMAC token generation, AES configuration encryption, and session tokens. It was classified under CWE-798 and CWE-1188.
FileRise addressed CVE-2026-33072 in version 3.9.0, fixing a hardcoded default encryption key that could let unauthenticated attackers forge upload tokens and decrypt sensitive configuration secrets. The flaw affected versions prior to 3.9.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public proof-of-concept code has been released for three high-severity vulnerabilities in the open-source **File Browser** self-hosted file management application, including **`CVE-2026-73611`**, **`CVE-2026-73612`**, and **`CVE-2026-73613`**. The issues affect File Browser/File Server releases up to **2.63.21** in the broader advisory, while individual fixes were introduced in later versions, including **2.63.22** for the recursive-operations access-control flaw and **2.63.19** as unaffected for the symlink-based deletion issue. `CVE-2026-73612` allows authenticated users to bypass path-based access controls during recursive copy, rename, and delete operations, letting them manipulate restricted descendant files and directories. `CVE-2026-73613` enables arbitrary out-of-scope file deletion through symlink manipulation in the TUS upload cache eviction process, potentially deleting files outside an attacker’s authorized scope with only create permissions. Separately, `CVE-2026-73611` affects JWT-based proxy authentication and can allow expired tokens to be accepted and renewed under certain non-default logout configurations, creating an authentication and security-restrictions bypass risk. Organizations using File Browser have been urged to apply the latest vendor patches immediately.
Aug 14, 2026
Two high-severity vulnerabilities were disclosed affecting exposed application and device management surfaces, including a flaw that can give attackers **root access** and another that enables **arbitrary file write** through path traversal. **CVE-2026-3587** describes an unauthenticated remote attack path in a hidden CLI function that lets an attacker escape a restricted prompt and gain root access to the underlying Linux operating system, potentially leading to full device compromise. The issue was mapped to `CWE-912` and assigned a `CVSS v3.1` score vector of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with CERT VDE publishing advisory `VDE-2026-020`. A separate vulnerability, **CVE-2026-5027**, affects Langflow's `POST /api/v2/files` endpoint, where improper sanitization of the multipart `filename` parameter allows path traversal using `../` sequences. An authenticated attacker can exploit the bug to write files to arbitrary filesystem locations, creating a route to compromise confidentiality, integrity, and availability. The flaw was classified as `CWE-22`, carries the `CVSS v3.1` vector `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, and is referenced in Tenable advisory `TRA-2026-26`.
Jun 29, 2026
Progress disclosed two high-severity vulnerabilities in **Customer Managed ShareFile Storage Zones Controller (SZC)** that could expose organizations to unauthorized access and remote code execution. **`CVE-2026-2699`** allows an unauthenticated attacker to reach restricted configuration pages, creating a path to unauthorized system configuration changes and possible code execution. The flaw is rated **CVSS 9.8** (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) and is associated with **CWE-284** and **CWE-698**. A second issue, **`CVE-2026-2701`**, allows an authenticated user to upload a malicious file to the server and execute it, resulting in remote code execution in ShareFile SZC environments. That vulnerability carries a **CVSS 8.8** rating (`AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`) and is mapped to **CWE-94**, **CWE-78**, and **CWE-434**. The disclosures reference vendor security guidance for ShareFile and indicate that both flaws can significantly affect confidentiality, integrity, and availability in customer-managed deployments.
Jun 29, 2026