What is CVE-2026-64856?

CVE-2026-64856 is a low-severity vulnerability in Error311 Filerise, classified under Information Disclosure. CVSS score: 3.7/10. Published 2026-10-14.

How severe is CVE-2026-64856?

Low severity. CVSS v3 base score is 3.7 out of 10.

Auth bypass in Error311 Filerise

CVE-2026-64856

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.20.0, FileRise /api/file/snippet.php does not apply the standard authenticated-session guard before processing short text preview requests. The endpoint still performs FileRise ACL checks, so normal installations do not expose an unauthenticated arbitrary file read, but unauthenticated requests can reach ACL evaluation instead of receiving an immediate 401 response. Only additional unusual proxy-header or ACL misconfiguration is documented as allowing requests to proceed into path and file-content handling. This issue is fixed in version 3.20.0.

Vulnerability class: Information Disclosure

Published 2026-10-14 · last modified 2026-10-15.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Error311 Filerise — versions < 3.20.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-64856?: CVE-2026-64856 is a low-severity vulnerability in Error311 Filerise, classified under Information Disclosure. CVSS score: 3.7/10. Published 2026-10-14.
How severe is CVE-2026-64856?: Low severity. CVSS v3 base score is 3.7 out of 10.