Platform
php
Component
filerise
Fixed in
2.7.2
CVE-2025-68116 affects FileRise, a self-hosted web file manager and WebDAV server. This vulnerability stems from inadequate handling of user-uploaded files, specifically SVG and HTML content, leading to a Stored Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to execute arbitrary JavaScript code within the context of another user's browser, potentially leading to account compromise or data theft. Versions prior to 2.7.1 are vulnerable; the issue is resolved in version 2.7.1.
The impact of CVE-2025-68116 is significant due to the potential for remote code execution within a user's browser. An attacker can upload a malicious SVG or HTML file to a FileRise instance. When a victim clicks on a share link generated by FileRise (/api/file/share.php) or attempts to directly download the file (/api/file/download.php), the malicious code embedded in the file is executed. This could result in the attacker stealing session cookies, redirecting the user to a phishing site, or even gaining control of the user's FileRise account. The blast radius extends to all users who interact with share links or download files from a vulnerable FileRise instance, making it a widespread risk, especially in environments where FileRise is used for sharing sensitive documents.
CVE-2025-68116 was published on December 16, 2025. Its severity is rated as HIGH (CVSS 8.9). There is no indication of this vulnerability being actively exploited in the wild at this time. Public proof-of-concept (POC) code is not yet available, but the nature of the vulnerability suggests that it is likely to be developed and shared. The vulnerability is not currently listed on CISA KEV or EPSS, suggesting a low to medium probability of exploitation in the near term, but this could change as awareness increases.
Exploit Status
EPSS
0.05% (16% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-68116 is to immediately upgrade FileRise to version 2.7.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Strictly validate and sanitize all user-uploaded files, particularly SVG and HTML content. Implement Content Security Policy (CSP) headers to restrict the execution of inline scripts and external resources. Monitor FileRise logs for suspicious file uploads or unusual activity. Web Application Firewalls (WAFs) can be configured to detect and block requests containing potentially malicious SVG or HTML payloads, though this is not a substitute for patching. After upgrading, confirm the fix by attempting to upload a test SVG file containing a simple JavaScript alert and verifying that the alert does not execute when accessing the share link or direct download.
Actualice FileRise a la versión 2.7.1 o superior. Esta versión corrige la vulnerabilidad XSS al manejar archivos SVG y HTML. La actualización evitará la ejecución de código JavaScript malicioso al acceder a enlaces compartidos o descargar archivos.
Vulnerability analysis and critical alerts directly to your inbox.
It's a Stored Cross-Site Scripting (XSS) vulnerability in FileRise web file manager versions prior to 2.7.1, allowing attackers to execute JavaScript code.
If you are using FileRise version 2.7.1 or earlier, you are vulnerable. Check your FileRise version immediately.
Upgrade FileRise to version 2.7.1 or later. Implement strict file validation and Content Security Policy (CSP) as temporary mitigations.
There's no current evidence of active exploitation, but the vulnerability's nature makes it likely to be targeted.
Refer to the FileRise security advisory and the NVD entry for CVE-2025-68116 for detailed information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.