CVE-2026-104107

Executive Summary

CVE-2026-104107 is a path traversal vulnerability (CWE-22) in FileRise, a self-hosted web-based file manager. In version 3.22.0, the /api/file/saveFile.php endpoint accepts attacker-controlled dot and dot-dot segments in its folder input before ACL inheritance evaluates the uncanonicalized string. An authenticated non-administrator user with a valid CSRF token, inherited edit permission on a legitimate ancestor folder, and access to the endpoint can create files outside their authorized folder, potentially extending outside the configured WebDAV root.

Technical Analysis

The vulnerability resides in the file-save operation exposed at /api/file/saveFile.php. FileRise 3.22.0 passes the attacker-controlled folder parameter into access-control logic prior to canonicalization. Because dot (.) and dot-dot (..) path segments are accepted at that stage, the ACL inheritance check runs against an uncanonicalized string rather than the final resolved path. Once the ACL check passes on a legitimate ancestor, the underlying storage abstraction—either the local filesystem adapter or the WebDAV adapter—resolves the embedded traversal segments as normal path navigation.

Two contributing weaknesses compound the primary flaw. First, the local storage adapter was observed to create directories before the final containment validation was performed, meaning side effects (directory creation) occur before the application verifies that the requested path stays within an authorized root. Second, the containment check itself used a prefix comparison that accepted similarly named sibling roots (for example, a root whose path begins with the same string as an authorized root), rather than enforcing a canonical directory-boundary check.

The net effect is an authorization bypass expressed as path traversal: a user who legitimately holds edit permission only over /authorized/subdir can direct the save operation to write files into a parent, sibling, or other location outside that scope. Where the WebDAV backend credentials grant broader reach, writes can escape the configured WebDAV root entirely. The issue is remediated in FileRise 3.23.0.

Because the endpoint is network-reachable and the CVSS vector shows no user interaction (UI:N) and low attack complexity (AC:L), the principal constraint on exploitation is the prerequisite of an authenticated session and a valid CSRF token. Integrity impact is rated High (I:H), while confidentiality and availability impacts are None. The scope is unchanged (S:U), consistent with the flaw remaining within the application's own security authority.

The required CSRF token indicates the request must originate in a context that has obtained the token legitimately—typically a logged-in browser session—further emphasizing that this is a post-authentication privilege/scoping bypass rather than an unauthenticated flaw.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description, and restricted to implementation details explicitly stated there.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed FileRise 3.22.0 instance. FileRise is a self-hosted file manager, so exposed instances are likely on internal networks or behind reverse proxies. The attacker verifies the version and confirms the /api/file/saveFile.php endpoint is present, and confirms the WebDAV or local storage backend in use.

2. Prerequisite acquisition. The attacker obtains an authenticated non-administrator session. This may be a legitimate low-privilege account or a compromised one. The actor also needs (a) inherited edit permission on some legitimate ancestor folder so the ACL inheritance check has a valid basis to evaluate, and (b) a valid CSRF token for the session.

3. Triggering the flaw. The attacker issues a save request to /api/file/saveFile.php with a folder value containing dot-dot segments that navigate from the authorized ancestor toward a target location. Because the ACL inheritance check evaluates the uncanonicalized string and passes on the ancestor, and because the storage adapter later resolves the traversal segments as path navigation, the write proceeds to the destination chosen by the attacker rather than the authorized folder.

4. Storage-backend resolution and side effects. On the local filesystem adapter, directory creation can occur before final containment validation, and the prefix-based containment check can be defeated by similarly named sibling roots—so directory side effects and files may land outside the intended root. On a WebDAV adapter, if the backed credentials permit broader reach, the resolved path can escape the configured WebDAV root, writing outside the intended storage boundary.

5. Post-exploitation impact. The outcome is attacker-controlled file creation outside the authorized folder. Depending on the deployment, this can place files into locations the user should not control, and—where the WebDAV backend credentials allow—outside the configured WebDAV root entirely. Impact is confined to integrity (file creation/write); the vector records no confidentiality or availability impact.

Impact Assessment

The direct impact is unauthorized file creation (integrity, I:H) by an authenticated non-administrator. Confidentiality and availability are rated None per the CVSS vector. The attack is network-reachable (AV:N), low complexity (AC:L), requires low privileges (PR:L), and needs no user interaction (UI:N). The overall base score is 6.5 (Medium), with scope unchanged (S:U).

Operationally, the blast radius depends on the storage backend and credentials:

• Local storage: writes outside the authorized folder, with possible directory creation occurring before containment validation, and containment checks that may be satisfied by similarly named sibling roots. This can place files into sibling or parent directories relative to the authorized folder.
• WebDAV storage: if backend credentials permit, writes can extend outside the configured WebDAV root, meaning the effective boundary is the WebDAV account's permissions rather than FileRise's intended per-folder ACLs.

Affected systems are FileRise 3.22.0 deployments using the local filesystem or WebDAV adapter with ACL inheritance and non-administrator accounts that hold scoped edit permissions. Because FileRise is self-hosted, exposed instances represent the primary risk; multi-tenant or shared deployments where least privilege matters most see the greatest relative impact.

Detection Guidance

Sigma Rule

title: FileRise Path Traversal in saveFile.php folder Parameter (CVE-2026-104107)
id: 6f1c9a2e-3b7d-4c5a-9e10-2a8d4b6f7c01
status: experimental
description: Detects FileRise saveFile.php requests containing dot-dot traversal sequences in the folder parameter, indicative of CVE-2026-104107 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-104107
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
    - attack.t1190
    - attack.initial_access
logsource:
    category: webserver
detection:
    selection_endpoint:
        cs-uri-stem|endswith: '/api/file/saveFile.php'
    selection_traversal:
        cs-uri-query|contains:
            - 'folder=..'
            - 'folder=../'
            - 'folder=..%2f'
            - 'folder=..%5c'
            - '%2e%2e'
    condition: selection_endpoint and selection_traversal
fields:
    - c-ip
    - cs-uri-stem
    - cs-uri-query
    - sc-status
falsepositives:
    - Legitimate clients encoding '.' in unexpected ways (rare)
level: high

YARA Rule

rule CVE_2026_104107_FileRise_SaveFile_Traversal
{
    meta:
        description = "Detects path traversal payloads targeting FileRise saveFile.php (CVE-2026-104107)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104107"
        date = "2026-01-01"
        severity = "high"

    strings:
        $ep = "/api/file/saveFile.php" ascii nocase
        $t1 = "folder=../" ascii nocase
        $t2 = "folder=..%2f" ascii nocase
        $t3 = "folder=..%5c" ascii nocase
        $t4 = "%2e%2e%2f" ascii nocase
        $t5 = "..%2f..%2f" ascii nocase

    condition:
        $ep and any of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104107 FileRise saveFile.php path traversal attempt"; flow:to_server,established; http.uri; content:"/api/file/saveFile.php"; http.uri; content:"folder="; distance:0; pcre:"/folder=(?:%2e|\.){2}(?:%2f|\/|%5c|\\|%252e)/i"; classtype:web-application-attack; reference:cve,2026-104107; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104107; sid:2026104107; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST"
      and url.path == "/api/file/saveFile.php"
      and url.query : "folder=*" ]
  [ network where http.request.method == "POST"
      and url.path == "/api/file/saveFile.php"
      and (url.query : "*..*" or url.query : "*%2e%2e*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval uri=coalesce(uri, cs_uri_stem), query=coalesce(uri_query, cs_uri_query), src=coalesce(clientip, c_ip)
| where match(uri, "/api/file/saveFile\.php$")
| where match(lower(query), "folder=.*(\.\.|%2e%2e|%252e)")
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,fileRise,">
  <rule id="2026107" level="12">
    <if_sid>31100,31101,31108</if_sid>
    <field name="url">/api/file/saveFile\.php</field>
    <regex type="pcre2">(?i)folder=[^&]*(\.\.|%2e%2e|%252e)</regex>
    <description>FileRise saveFile.php path traversal attempt (CVE-2026-104107)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor workaround is documented.

1. Immediate mitigations (apply while an upgrade path is validated):
   • Restrict network access to FileRise instances. Place them behind an authenticating reverse proxy or VPN; do not expose them directly to untrusted networks.
   • Tighten ACLs: avoid granting non-administrator accounts edit/inherited-edit permissions on folders they do not strictly require. Reduce the number of accounts that can reach /api/file/saveFile.php with edit scope.
   • Where the storage backend supports it, constrain the WebDAV account credentials so they cannot write outside the intended root, limiting the escape reach described in the advisory.
   • Monitor and alert on traversal sequences in the folder parameter (see Detection Guidance above).
2. Patch/upgrade steps:
   • Upgrade FileRise to 3.23.0, which contains the fix per the advisory. Verify the installed version after upgrading and re-test that traversal segments in the folder parameter are canonicalized and rejected.
   • Because no patch evidence is available from tracked sources, validate the fixed build against your deployment and confirm the version before relying on the remediation.
3. Long-term hardening:
   • Implement canonicalization and directory-boundary validation on all path inputs prior to ACL evaluation, and avoid prefix-string containment checks in favor of canonical path-boundary comparisons.
   • Perform containment validation before creating directories or writing files, so failed validation produces no side effects.
   • Adopt least-privilege for storage backend credentials (local and WebDAV) so a bypass cannot exceed the intended root.
   • Add CSRF token handling consistent with the expected flow and monitor for anomalous save operations by non-administrator accounts.

References

• NVD — CVE-2026-104107: https://nvd.nist.gov/vuln/detail/CVE-2026-104107
• MITRE CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — CVE-2026-104107 (not yet scored by FIRST.org): https://api.first.org/data/v1/epss?cve=CVE-2026-104107
• FileRise project (self-hosted web-based file manager) — consult the upstream project for the 3.23.0 release and advisory details.

No CISA KEV listing, no public PoC, no Nuclei template, and no exploit-in-the-wild or threat-actor campaign evidence were identified for this CVE in the data provided.