{"metadata": {"vulnerability": "CVE-2026-54459", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-06-15T15:30:40.318Z", "date_only": false, "value": "2026-06-15T15:30:40.318Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-54459", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-12T21:55:15.872Z", "date_only": false, "value": "2026-10-12T21:55:15.872Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-54459", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-12T21:55:15.872Z", "date_only": false, "value": "2026-10-12T21:55:15.872Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-54459", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-12T22:14:16.086Z", "date_only": false, "value": "2026-10-12T22:14:16.086936Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117430239090735128", "record": "CVE-2026-54459", "field": "creation_timestamp", "uuid": "0705fd92-d299-476f-af99-b09056a2e42d", "content": "CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-54459https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47ghttps://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851#error311 #FileRise#CVE_2026_54459#bot", "url": "https://infosec.exchange/users/cve/statuses/117430239090735128"}, {"timestamp": "2026-10-12T22:17:04.780Z", "date_only": false, "value": "2026-10-12T22:17:04.780", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54459", "record": "FKIE_CVE-2026-54459", "field": "published"}, {"timestamp": "2026-10-13T13:44:47.178Z", "date_only": false, "value": "2026-10-13T13:44:47.178669Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54459", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-13T13:44:47.178Z", "date_only": false, "value": "2026-10-13T13:44:47.178669Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54459", "record": "FKIE_CVE-2026-54459", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-13T13:45:09.011Z", "date_only": false, "value": "2026-10-13T13:45:09.011Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-54459", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T13:45:09.011Z", "date_only": false, "value": "2026-10-13T13:45:09.011Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-54459", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T14:17:38.493Z", "date_only": false, "value": "2026-10-13T14:17:38.493", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54459", "record": "FKIE_CVE-2026-54459", "field": "lastModified"}]}