FileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence Oracle

The core of this vulnerability lies in the Resumable.js chunked upload handler within FileRise. Specifically, the resumableIdentifier parameter is directly concatenated into file system paths without proper sanitization. This lack of validation enables an attacker to craft malicious upload requests that include directory traversal sequences (e.g., ../../../../). Successful exploitation allows an attacker to write arbitrary files to any location accessible by the FileRise process, potentially overwriting critical system files or injecting malicious code. Furthermore, the cleanup process after assembly can be exploited to delete directories, leading to denial of service or further compromise. The ability to probe file and directory existence also provides reconnaissance capabilities, allowing attackers to map the file system and identify valuable targets.

Organizations and individuals using FileRise for self-hosting file management and WebDAV services are at risk. This includes users deploying FileRise on shared hosting environments, as the vulnerability could be exploited by other tenants on the same server. Legacy FileRise installations with outdated configurations and weak access controls are particularly vulnerable.

• linux / server: Monitor FileRise logs for suspicious file creation or deletion attempts, particularly those containing directory traversal sequences (e.g., ../).

journalctl -u FileRise -f | grep -i 'traversal'

• generic web: Check FileRise access logs for requests containing unusual paths or directory traversal sequences in the resumableIdentifier parameter.

grep 'resumableIdentifier=../' /var/log/apache2/access.log

1. 2026-03-24Disclosure

   disclosure

1. Reserviert2026-03-18
2. Veröffentlicht2026-03-24
3. Geändert2026-03-25
4. EPSS aktualisiert2026-04-01

The primary mitigation for CVE-2026-33329 is to immediately upgrade FileRise to version 3.10.0 or later, which includes the necessary sanitization fixes. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious directory traversal sequences in the resumableIdentifier parameter. Carefully review and restrict user permissions related to file uploads to limit the potential impact of a successful attack. Monitor FileRise logs for unusual file access or modification patterns that might indicate exploitation attempts.