CVE-2026-104109

Executive Summary

FileRise is a self-hosted, web-based file manager supporting multi-file upload, editing, and batch operations. Prior to version 3.23.0, an authenticated non-administrator user holding extract permission can exploit a link-following flaw: archive entries are extracted directly into the live destination before their resolved paths are validated, allowing an ordinary ZIP entry to overwrite (and via cleanup, delete) files outside the storage root through a pre-existing symlink. Impact is limited to integrity and availability (CVSS 6.8) and is constrained by high attack complexity and the unproven ability of the attacker to first create the required symlink.

Technical Analysis

The vulnerability is a classic link-following / archive extraction path-traversal issue classified as CWE-59 (Improper Link Resolution Before File Access, "Link Following"). The mechanism described in the NVD entry is ordering-dependent:

1. FileRise validates archive entry names (i.e., it inspects the names of the members inside the ZIP).
2. Critically, it extracts the entries directly into the authorized live destination before validating resolved paths. This inversion is the core defect. Validation of the resolved (real) filesystem path occurs too late — after extraction has already occurred.
3. The attack precondition is a symlink already present inside the destination folder that points to a directory outside the storage root. If that link exists, an archive entry whose name resolves beneath the link writes through the link and lands on the external target.
4. ZipArchive::extractTo() — the PHP extraction primitive explicitly named in the description — will write the entry's contents to that resolved external location. An "ordinary" archive entry (not a crafted traversal string) is sufficient; the symlink does the redirection.
5. A post-extraction cleanup routine then performs deletion "through the same linked parent," meaning the cleanup can also remove the external target file, provided the FileRise process has the necessary filesystem write or removal permission.

Two important scoping constraints are stated in the source material and must be preserved: (a) the advisory does not establish that the attacker can create the prerequisite symlink through FileRise itself, and (b) both the overwrite and the deletion are conditioned on the FileRise process holding the required filesystem write/removal permission on the external target. There is no published detail on entry-name sanitization internals, allowed archive formats beyond ZIP, or cleanup routine implementation; those specifics are not available and are not asserted here.

The vulnerability requires authentication (PR:L) and an account with extract permission; it is network-reachable (AV:N), needs no user interaction (UI:N), and does not cross a security scope boundary (S:U). High attack complexity (AC:H) reflects the symlink precondition and the permission dependency. Integrity (I:H) and Availability (A:H) are high because arbitrary external files within the process's reach can be overwritten or deleted; Confidentiality (C:N) is unaffected because the issue is a write/delete path, not a disclosure path.

Exploitation Scenarios

No public proof-of-concept exists for CVE-2026-104109, and the attack chain below is inferred from the vulnerability class (CWE-59) and the described mechanism. No specific function names, endpoints, parameters, or internal file paths beyond those in the NVD description (ZipArchive::extractTo()) are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed FileRise instance prior to 3.23.0, and obtains (or already holds) a valid non-administrator account. The account must have permission to extract archives and the ability to upload or otherwise place a file into a target folder inside the storage root.

2. Triggering the flaw class. The prerequisite is a symlink in the destination folder pointing outside the storage root. The advisory does not establish that FileRise can be used to create such a link; therefore this step may depend on a separate pre-existing condition (e.g., a link placed by another local process or an earlier administrative action). Once a symlink pointing outside the storage root exists in the target folder, the attacker places an attacker-controlled ZIP into that folder — either via upload or by otherwise getting the file there.

3. Payload placement / execution method. Inside the ZIP, the attacker includes an ordinary archive entry that resolves beneath the existing link. Because FileRise extracts entries before it validates the resolved paths, ZipArchive::extractTo() follows the symlink and writes the entry's content to the external destination — overwriting a file outside the storage root. No malicious traversal string is required; the redirection is performed by the link.

4. Post-exploitation impact. After extraction, FileRise's post-extraction cleanup can delete the same external target through the linked parent. The practical outcomes are file overwrite (integrity) and file removal (availability) of any path the FileRise process can write to or delete — for example, configuration or data files owned by the service account. Both effects are gated on the process's filesystem permissions. No remote code execution or information disclosure is described.

Impact Assessment

CVE-2026-104109 carries a CVSS 3.1 base score of 6.8 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H. The integrity and availability subscores are High, while confidentiality is None. The blast radius is bounded by three factors: (1) the attacker must be an authenticated, non-administrator user who already has extract permission and a means to place a ZIP in the vulnerable folder; (2) a symlink pointing outside the storage root must already exist in that destination; and (3) the FileRise process must possess write or delete rights on the external target. Where these conditions are met — common on misconfigured self-hosted deployments that run the service under a broadly privileged account — an attacker can overwrite or destroy files outside the managed storage root, potentially corrupting application state, configuration, or adjacent data directories and causing a denial-of-service condition. CISA KEV listing: No. EPSS: not yet scored by FIRST.org (no value is fabricated here).

Detection Guidance

Sigma Rule

title: FileRise Archive Extraction Symlink Escape (CVE-2026-104109)
id: 7f2b1e94-0c6d-4c3f-9c0a-filerise0109
status: experimental
description: Detects ZIP extraction by FileRise followed by file writes or deletions resolving outside the storage root, consistent with symlink-following extraction abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104109
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  category: file_event
detection:
  selection_extract:
    Image|endswith: '/php'
    CommandLine|contains: 'extractTo'
  selection_outside_root:
    TargetFilename|startswith:
      - '/etc/'
      - '/var/www/'
      - '/root/'
      - '/opt/'
  condition: selection_extract and selection_outside_root
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - Legitimate administrative extractions to non-standard directories
level: medium
tags:
  - attack.t1190
  - cve.2026-104109

YARA Rule

rule CVE_2026_104109_FileRise_Symlink_Extract
{
    meta:
        description = "Detects PHP archive extraction logic associated with FileRise symlink-following extraction (CVE-2026-104109)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104109"
        date = "2026-01-01"
    strings:
        $ext = "extractTo" ascii nocase
        $zap = "ZipArchive" ascii nocase
        $fr  = "FileRise" ascii nocase
    condition:
        filesize < 5MB and $zap and $ext and $fr
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104109 FileRise archive extraction attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"extract"; nocase; http.header; content:"Content-Type"; content:"multipart/form-data"; nocase; classtype:attempted-user; reference:cve,2026-104109; sid:2026104109; rev:1;)

Elastic Detection

file where process.name == "php" and file.name : "*.zip" and
  not file.path : ("/var/www/filerise/storage/*", "/srv/filerise/*") and
  event.action in ("creation", "deletion", "change")

Splunk SPL Query

index=linux OR index=web sourcetype=auditd OR sourcetype=sysmon
| search (process="*php*" AND (file_path="*extract*" OR signature="*ZipArchive*"))
| eval outside_root=if(match(file_path,"^/(etc|root|var/www|opt)/"),1,0)
| where outside_root=1
| stats count min(_time) as first_seen max(_time) as last_seen by host user file_path process
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="filerise,cve-2026-104109,">
  <rule id="2026109" level="10">
    <if_sid>550</if_sid>
    <field name="file">\.zip$</field>
    <match>extract</match>
    <description>CVE-2026-104109: FileRise archive extraction writing outside storage root (possible symlink escape)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,file_integrity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in version 3.23.0, but no vendor advisory, commit, or distribution patch has been independently tracked; treat this as unverified until upstream confirmation is obtained.

1. Immediate mitigations

   • Remove or disallow any symlinks inside FileRise storage roots that point outside those roots; audit destination folders for such links and replace them with real directories where possible.
   • Run the FileRise process under a least-privilege account with write/delete rights confined strictly to the storage root, so an escape cannot overwrite or delete files elsewhere.
   • Restrict the extract permission to trusted users only, and monitor for ZIP placement in folders holding symlinks.
   • Where extraction is not essential, disable it entirely.

2. Patch / upgrade steps

   • Upgrade FileRise to 3.23.0 or later as stated in the NVD description. Because patch evidence is not tracked, verify the fix against the upstream release notes before relying on it, and confirm the deployment artifact hash and version string.

3. Long-term hardening

   • Validate resolved (canonical) paths before extraction and reject entries whose realpath escapes the storage root; do not follow symlinks during extraction.
   • Adopt an extraction workflow that writes to an isolated staging directory and moves validated content into place afterward.
   • Enforce file-system ACLs and container/namespace isolation so the service account cannot reach non-storage paths.
   • Continuously monitor vendor channels for a formal advisory and re-score patch confidence when evidence appears.

References

• NVD — CVE-2026-104109: https://nvd.nist.gov/vuln/detail/CVE-2026-104109
• CWE-59 — Improper Link Resolution Before File Access ("Link Following"): https://cwe.mitre.org/data/definitions/59.html
• FileRise project (self-hosted web-based file manager) upstream repository/release notes for version 3.23.0
• FIRST.org EPSS (no score published at time of writing): https://www.first.org/epss
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-104109 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code is available. There is no evidence of exploit-in-the-wild activity or named threat-actor campaigns targeting this CVE at the time of writing.