{"uuid": "0705fd92-d299-476f-af99-b09056a2e42d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54459", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117430239090735128", "content": "CVE-2026-54459 FileRise: Missing CSRF enforcement for file creation and share-link creation FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-54459https://github.com/error311/FileRise/security/advisories/GHSA-jp5j-9px9-g47ghttps://github.com/error311/FileRise/commit/7035f6ef5a0b31e3116334ac621cbf2a3609d851#error311 #FileRise#CVE_2026_54459#bot", "creation_timestamp": "2026-10-12T22:14:16.086936Z"}