CVE-2025-68116

Executive Summary

CVE-2025-68116 is a critical Stored Cross-Site Scripting (XSS) vulnerability affecting FileRise, a self-hosted web file manager and WebDAV server. Versions prior to 2.7.1 fail to properly sanitize user-uploaded files, specifically SVG and HTML files, when served through the sharing and download endpoints. An attacker can upload a malicious SVG or HTML file, and when a victim accesses a generated share link or the direct download endpoint, the attacker's JavaScript executes in the victim's browser. This can lead to session hijacking, data theft, or further compromise of the FileRise instance. The vulnerability is rated with a CVSS score of 8.9 (High) and has a public proof-of-concept. No EPSS activity has been detected, but the risk is significant due to the ease of exploitation and the potential for widespread impact.

Supply Chain & Package Security

FileRise is a self-hosted PHP application. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's own file handling logic. The supply chain risk is limited to the application's codebase and its dependencies. Users should ensure they are using the official FileRise source and verify the integrity of their installation.

CVSS Breakdown & Threat Level

• CVSS Score: 8.9 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - An unauthenticated attacker can upload a malicious file.
• User Interaction (UI): Required (R) - The victim must click on a share link or download the file.
• Scope (S): Changed (C) - The impact extends beyond the vulnerable component.
• Confidentiality (C): High (H) - An attacker can steal sensitive data.
• Integrity (I): High (H) - An attacker can modify data or perform actions on behalf of the victim.
• Availability (A): High (H) - An attacker can potentially disrupt the service.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to full compromise of the victim's session and the FileRise instance.

Deep Dive & Mechanics

The vulnerability resides in the share.php and download.php endpoints. When a user uploads a file, FileRise stores it on the server. When a share link is generated, the file is served directly to the browser without proper Content-Type validation or sanitization. An attacker can upload a crafted SVG file containing embedded JavaScript. When a victim opens the share link, the browser renders the SVG, executing the attacker's script. Similarly, the download endpoint may serve the file with a Content-Type that the browser interprets as HTML, leading to script execution.

Root Cause: The application does not validate the MIME type or content of uploaded files before serving them. It relies on the file extension, which can be easily spoofed. The fix in version 2.7.1 likely involves adding Content-Type headers (e.g., Content-Type: application/octet-stream) for SVG and HTML files, or stripping script tags from uploaded content.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.7.1): The vulnerable code likely serves files without setting a strict Content-Type header, allowing the browser to sniff the content type.

// share.php (vulnerable)
$file_path = '/path/to/uploads/' . $_GET['file'];
header('Content-Type: ' . mime_content_type($file_path));
readfile($file_path);

Patched Code (2.7.1+): The patched code forces a download or sets a safe Content-Type for potentially dangerous file types.

// share.php (patched)
$file_path = '/path/to/uploads/' . $_GET['file'];
$ext = pathinfo($file_path, PATHINFO_EXTENSION);
if (in_array($ext, ['svg', 'html', 'htm'])) {
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . basename($file_path) . '"');
} else {
    header('Content-Type: ' . mime_content_type($file_path));
}
readfile($file_path);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A FileRise instance (version < 2.7.1) with file upload enabled.
• Ability to create a share link for an uploaded file.

Exploit Steps:

1. Create a malicious SVG file with embedded JavaScript:

   <svg xmlns="http://www.w3.org/2000/svg">
     <script>alert('XSS')</script>
   </svg>
   

2. Upload the file to the FileRise instance.
3. Generate a share link for the uploaded file.
4. Send the share link to the victim.
5. When the victim opens the link, the JavaScript executes.

Alternative Payload (HTML):

<html>
<body>
<script>alert('XSS')</script>
</body>
</html>

Blue Team (Detection & Hardening)

Detection:

• Monitor for uploads of SVG or HTML files.
• Monitor for access to share.php and download.php with unusual file extensions.
• Use a Web Application Firewall (WAF) to block requests with script tags in file content.

Hardening:

• Upgrade to FileRise 2.7.1 or later.
• If upgrade is not possible, implement a reverse proxy that blocks SVG/HTML files from being served with a renderable Content-Type.
• Disable file uploads for untrusted users.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • malicious.svg: a1b2c3d4e5f6... (example)
  • malicious.html: f6e5d4c3b2a1... (example)
• Network Indicators:
  • Requests to /api/file/share.php?file=malicious.svg
  • Requests to /api/file/download.php?file=malicious.html
• Log Entries:
  • Upload logs showing SVG or HTML files.
  • Access logs showing share.php or download.php with non-standard file extensions.

Detection Engineering

YARA Rule

rule CVE_2025_68116_FileRise_XSS {
    meta:
        description = "Detects malicious SVG/HTML files uploaded to FileRise"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68116"
    strings:
        $svg_script = /<svg[^>]*>.*?<script[^>]*>.*?<\/script>/is
        $html_script = /<html[^>]*>.*?<script[^>]*>.*?<\/script>/is
    condition:
        $svg_script or $html_script
}

Sigma Rule

title: FileRise Stored XSS Upload Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG or HTML files to FileRise
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/file/upload.php'
        cs-uri-query|contains: 
            - '.svg'
            - '.html'
    condition: selection
falsepositives:
    - Legitimate SVG/HTML file uploads
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-68116 FileRise Stored XSS - Malicious SVG Upload"; flow:to_server,established; content:"POST"; http_method; content:"/api/file/upload.php"; http_uri; content:".svg"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update FileRise to version 2.7.1 or later immediately.
2. Isolate: If upgrade is not possible, isolate the FileRise instance from untrusted networks.
3. Review: Audit uploaded files for malicious content.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
• Enforce strict Content-Type headers for all file downloads.
• Regularly update FileRise and its dependencies.
• Conduct security training for users on the risks of opening share links from untrusted sources.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact security@valters-it.com.