FileRise has Unauthenticated Share Link Deletion
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-33070
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 12:46 UTC · Revision 1
Source evidence
FileRise has Unauthenticated Share Link Deletion
core-osv · Original sourcePublished 20 Mar 2026, 08:25 UTC
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.
osv:CVE-2026-33070
Complete source record
{
"id": "883e4236e4684f0b3ac03bba15bb16711e1d9c8d23ebf42eb397f57a6bb0e355",
"url": "https://osv.dev/vulnerability/CVE-2026-33070",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "FileRise has Unauthenticated Share Link Deletion",
"summary": "FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.",
"evidence": "osv:CVE-2026-33070",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-33070",
"aliases": [
"CVE-2026-33070",
"GHSA-vh5m-w36c-99xv"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/error311/filerise",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "da9cbeee227fa06cf9134c458257a5abdcb690ed"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "3.8.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "da9cbeee227fa06cf9134c458257a5abdcb690ed"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v3.8.0"
},
{
"cpe": "cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.8.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.7.0",
"v3.6.1",
"v3.6.0",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.1",
"v3.4.0",
"v3.3.3",
"v3.3.2",
"v3.3.1",
"v3.3.0",
"v3.2.4",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.1.7",
"v3.1.6",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v2.13.1",
"v2.13.0",
"v2.12.1",
"v2.12.0",
"v2.11.4",
"v2.11.3",
"v2.11.2",
"v2.11.1",
"v2.11.0",
"v2.10.5",
"v2.10.4",
"v2.10.1",
"v2.9.3",
"v2.9.2",
"v2.8.0",
"v2.7.1",
"v2.7.0",
"v2.6.2",
"v2.6.1",
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.0",
"v2.3.7",
"v2.3.6",
"v2.3.5",
"v2.3.4",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.4",
"v2.2.3",
"v2.2.2",
"v2.2.1",
"v2.1.0",
"v2.0.4",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v1.9.14",
"v1.9.13",
"v1.9.12",
"v1.9.11",
"v1.9.10",
"v1.9.9",
"v1.9.8",
"v1.9.7",
"v1.9.6",
"v1.9.5",
"v1.9.4",
"v1.9.3",
"v1.9.2",
"v1.9.1",
"v1.9.0",
"v1.8.13",
"v1.8.12",
"v1.8.11",
"v1.8.10",
"v1.8.9",
"v1.8.8",
"v1.8.7",
"v1.8.6",
"v1.8.5",
"v1.8.4",
"v1.8.3",
"v1.8.2",
"v1.8.1",
"v1.8.0",
"v1.7.5",
"v1.7.4",
"v1.7.3",
"v1.7.2",
"v1.6.11",
"v1.6.10",
"v1.6.9",
"v1.6.8",
"v1.6.7",
"v1.6.6",
"v1.6.5",
"v1.6.3",
"v1.6.2",
"v1.6.1",
"v1.6.0",
"v1.5.3",
"v1.5.2",
"v1.5.1",
"v1.5.0",
"1.4.0",
"v1.3.15",
"v1.3.13",
"v1.3.9",
"v1.3.8",
"v1.3.7",
"v1.3.6",
"v1.3.5",
"v1.3.4",
"v1.3.3",
"v1.3.2",
"v1.3.1",
"v1.3.0",
"v1.2.8",
"v1.2.7",
"v1.2.6",
"v1.2.5",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.3",
"v1.1.2",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33070.json"
}
}
],
"modified": "2026-10-28T02:30:50.605558020Z",
"provider": "osv",
"references": [
"https://github.com/error311/FileRise/releases/tag/v3.8.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33070.json",
"https://github.com/error311/FileRise/security/advisories/GHSA-vh5m-w36c-99xv",
"https://nvd.nist.gov/vuln/detail/CVE-2026-33070"
],
"provider_metadata": {
"cwe_ids": [
"CWE-306"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33070.json"
}
},
"related_cves": [
{
"value": "CVE-2026-33070",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 519332,
"published_at": "2026-03-20T08:25:07.081+00:00"
}