Loading vulnerability…
Path Traversal in FileRise Resumable.js Upload Handler
CVE-2026-33329 is a path traversal / externally controlled path vulnerability in FileRise, a self-hosted web file manager and WebDAV server. Affected versions are 1.0.1 through before 3.10.0. The flaw is in the Resumable.js chunked upload handler, specifically UploadModel::handleUpload(), where the user-supplied resumableIdentifier parameter is concatenated directly into filesystem paths without sanitization or safe path enforcement. Because this identifier influences where upload chunks and assembled files are handled on disk, an authenticated user with upload permission can traverse outside the intended upload area. The advisory states this can be used to write files to arbitrary directories on the server, delete arbitrary directories during post-assembly cleanup, and probe the existence of files or directories.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privilege user with upload capability to perform unauthorized filesystem operations on the server. Specifically, the attacker can write files into arbitrary directories, which compromises integrity, delete arbitrary directories through the upload cleanup logic, which can disrupt service or destroy application data, and probe filesystem paths to determine whether files or directories exist. Based on the provided CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), the primary impact is high integrity and high availability impact, with no stated direct confidentiality impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict upload permissions to only fully trusted users, since exploitation requires an authenticated user with upload capability. Monitor and audit upload-related filesystem activity for unexpected directory creation, file writes outside intended upload paths, and anomalous deletion events. Where possible, harden the runtime environment so the FileRise process has minimal filesystem permissions and cannot write to or delete sensitive directories outside its intended data paths. Additional compensating controls may include isolating the application in a container or chroot-like environment and using filesystem ACLs to constrain damage from arbitrary path manipulation.
Patch, then assume compromise.
Upgrade FileRise to version 3.10.0 or later, which patches the vulnerability. The provided context also references a fixing commit, 3871f9fd1661688bed4f7dd23912be0ebf50973c, indicating the issue was addressed in the upstream codebase. If maintaining a fork or backporting fixes, ensure resumableIdentifier is not used directly in filesystem path construction, enforce canonicalization and path boundary checks, and restrict all upload-related file operations to a dedicated safe directory.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.