CVE-2025-62510: Filerise Information Disclosure Flaw

CVE-2025-62510 Overview

CVE-2025-62510 is a broken access control vulnerability in FileRise, a self-hosted web-based file manager that supports multi-file upload, editing, and batch operations. Version 1.4.0 introduced a regression that allowed folder visibility and ownership to be inferred from folder names. Low-privilege users could enumerate or interact with folders matching their username and, in some cases, access content owned by other users. The flaw maps to [CWE-280: Improper Handling of Insufficient Permissions or Privileges]. FileRise version 1.5.0 patches the issue with explicit per-folder Access Control Lists (ACLs) and strict server-side checks across list, read, write, share, rename, copy/move, zip, and WebDAV paths.

Critical Impact
Authenticated low-privilege users can view and interact with folders belonging to other users, breaking tenant isolation and exposing files across user boundaries.

Affected Products

FileRise version 1.4.0
FileRise versions prior to 1.5.0
FileRise WebDAV interface in affected versions

Discovery Timeline

2025-10-20 - CVE-2025-62510 published to the National Vulnerability Database (NVD)
2025-12-04 - Last updated in the NVD database

Technical Details for CVE-2025-62510

Vulnerability Analysis

The vulnerability stems from FileRise inferring folder ownership and visibility from folder name matching against the authenticated username. In version 1.4.0, the access control logic relied on implicit string conventions rather than explicit ownership records. A low-privilege user could enumerate folders whose names matched their own username and, in certain code paths, reach content owned by other users.

The affected code paths span the entire file management surface, including directory listing, file read and write, sharing, rename, copy and move, archive creation, and WebDAV operations. Because the same flawed assumption was reused across multiple controllers, a single regression produced a cross-cutting authorization gap. The fix in version 1.5.0 introduces a dedicated folder_owners.json metadata store and an ACL.php module that performs explicit per-folder checks for owners, read, write, share, and read_own permissions.

Root Cause

FileRise 1.4.0 derived authorization decisions from folder naming conventions rather than from an authoritative ownership map. Server-side checks did not validate the requesting user against a stored ACL before returning folder contents or accepting modifications. This pattern matches [CWE-280], where insufficient privilege handling allows actions outside the intended permission boundary.

Attack Vector

Exploitation requires an authenticated low-privilege account and network access to the FileRise web interface or WebDAV endpoint. The attacker issues normal API requests against folder paths matching their username or, in some paths, paths belonging to other users. The application returns folder contents or accepts write, rename, share, or copy operations without validating ownership.

php

// Patch excerpt: config/config.php (FileRise v1.5.0)
if (!defined('DEFAULT_BYPASS_OWNERSHIP')) define('DEFAULT_BYPASS_OWNERSHIP', false);
if (!defined('DEFAULT_CAN_SHARE'))        define('DEFAULT_CAN_SHARE', true);
if (!defined('DEFAULT_CAN_ZIP'))          define('DEFAULT_CAN_ZIP', true);
if (!defined('DEFAULT_VIEW_OWN_ONLY'))    define('DEFAULT_VIEW_OWN_ONLY', false);

define('FOLDER_OWNERS_FILE', META_DIR . 'folder_owners.json');

Source: FileRise commit b6d86b7

The patch introduces a persistent folder ownership map and default ACL flags. A new admin endpoint, public/api/admin/acl/getGrants.php, enumerates per-user grants and gates all access through the ACL.php library and FolderModel::getFolderList().

Detection Methods for CVE-2025-62510

Indicators of Compromise

Access log entries showing one authenticated user requesting folder paths that do not correspond to their assigned username or scope.
WebDAV PROPFIND, GET, or PUT requests from low-privilege accounts targeting directories owned by other users.
Unexpected entries in FileRise share, rename, copy, or zip endpoints referencing folders outside the caller's namespace.

Detection Strategies

Review FileRise application logs for cross-user folder access patterns, focusing on list, read, write, share, rename, copy, move, and zip endpoints.
Correlate authenticated session identifiers with the folder paths accessed and flag deviations from the user's own namespace.
Inspect reverse-proxy or web server access logs for repeated 200-status responses to folder paths matching usernames other than the session owner.

Monitoring Recommendations

Enable verbose request logging on the FileRise host and forward logs to a central analytics platform for cross-user access correlation.
Monitor WebDAV traffic volume and target paths per user to detect enumeration of other users' folders.
Alert on administrative API calls to /api/admin/acl/ endpoints after upgrade to track ACL changes and unexpected privilege grants.

How to Mitigate CVE-2025-62510

Immediate Actions Required

Upgrade FileRise to version 1.5.0 or later, which introduces explicit per-folder ACLs and strict server-side authorization checks.
Audit existing folder structures for names that overlap with usernames and confirm ownership assignments after upgrade.
Rotate credentials for any low-privilege account that may have been used to access other users' content.

Patch Information

The fix is delivered in FileRise 1.5.0. The relevant changes are documented in the GitHub Security Advisory GHSA-jm96-2w52-5qjj and implemented in commit b6d86b7. The patch adds a folder_owners.json metadata file, an ACL.php enforcement library, and default ACL constants such as DEFAULT_BYPASS_OWNERSHIP, DEFAULT_CAN_SHARE, DEFAULT_CAN_ZIP, and DEFAULT_VIEW_OWN_ONLY. Server-side checks are applied across list, read, write, share, rename, copy/move, zip, and WebDAV paths.

Workarounds

Restrict FileRise access to trusted networks or place the application behind a reverse proxy that enforces additional authentication until the patch is applied.
Disable WebDAV functionality if it is not required, reducing the exposed surface for cross-user folder access.
Limit account creation to administrators and avoid provisioning shared low-privilege accounts on affected instances.

bash

# Upgrade FileRise to the patched release
git fetch --tags
git checkout v1.5.0

# Verify the patched ACL components are present
test -f src/lib/ACL.php && echo "ACL module present"
test -f public/api/admin/acl/getGrants.php && echo "Admin ACL endpoint present"