https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-33477.htmlhttps://patchthecve.com/cve/CVE-2026-33477.htmlWed, 17 Jun 2026 10:37:33 +0000MEDIUM 4.3: FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In versiosn 2.3.7 through 3.10.0, the file snippet endpoint `/api/file/snippet.php` allows an authenticated user with only `read_own` access to a folder to retrieve snippet content from files uplohttps://patchthecve.com/cve/CVE-2026-33330.htmlhttps://patchthecve.com/cve/CVE-2026-33330.htmlWed, 17 Jun 2026 10:37:19 +0000HIGH 7.1: FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows an authenticated user with read-only access to obtain a signed save callbackUrl for a file and then directly forge the ONLYOFFICE save callbahttps://patchthecve.com/cve/CVE-2026-33329.htmlhttps://patchthecve.com/cve/CVE-2026-33329.htmlWed, 17 Jun 2026 10:37:19 +0000HIGH 8.1: FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler (UploadModel::handleUpload()) is concatenated directly into filesystem paths without any sanitization. An authenticatehttps://patchthecve.com/cve/CVE-2026-33072.htmlhttps://patchthecve.com/cve/CVE-2026-33072.htmlWed, 17 Jun 2026 10:36:54 +0000HIGH 8.2: FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attachttps://patchthecve.com/cve/CVE-2026-33071.htmlhttps://patchthecve.com/cve/CVE-2026-33071.htmlWed, 17 Jun 2026 10:36:54 +0000MEDIUM 4.3: FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, the WebDAV upload endpoint accepts any file extension including .phtml, .php5, .htaccess, and other server-side executable types, bypassing the filename validation enforced by the regular upload path. In non-defahttps://patchthecve.com/cve/CVE-2026-33070.htmlhttps://patchthecve.com/cve/CVE-2026-33070.htmlWed, 17 Jun 2026 10:36:54 +0000LOW 3.7: FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared f