What is CVE-2026-33070?

CVE-2026-33070 is a low-severity vulnerability in Error311 Filerise, classified under Missing Authentication for Critical Function. CVSS score: 3.7/10. Published 2026-03-20.

How severe is CVE-2026-33070?

Low severity. CVSS v3 base score is 3.7 out of 10.

Auth bypass in Error311 Filerise

CVE-2026-33070

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.8.0, a missing-authentication vulnerability in the deleteShareLink endpoint allows any unauthenticated user to delete arbitrary file share links by providing only the share token, causing denial of service to shared file access. The POST /api/file/deleteShareLink.php endpoint calls FileController::deleteShareLink() which performs no authentication, authorization, or CSRF validation before deleting a share link. Any anonymous HTTP client can destroy share links. This issue is fixed in version 3.8.0.

Vulnerability class: Broken Authentication

EPSS: 0.004 (30.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Error311 Filerise — versions < 3.8.0
Filerise

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Mitigation, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-33070?: CVE-2026-33070 is a low-severity vulnerability in Error311 Filerise, classified under Missing Authentication for Critical Function. CVSS score: 3.7/10. Published 2026-03-20.
How severe is CVE-2026-33070?: Low severity. CVSS v3 base score is 3.7 out of 10.