FileRise versions prior to 2.7.1 contain a Stored Cross-Site Scripting vulnerability that permits unauthorized JavaScript execution, posing a significant risk to user session security.

This vulnerability is a Stored Cross-Site Scripting (CWE-79) flaw occurring in the sharing and download endpoints (share.php and download.php). An authenticated attacker can upload crafted SVG or HTML files that execute arbitrary JavaScript in the browser of any user who accesses the generated share link.

The ability for an attacker to execute arbitrary JavaScript in the context of a user session can lead to session hijacking, unauthorized actions performed on behalf of the victim, and potential exfiltration of sensitive files managed within the FileRise instance. With a CVSS score of 8.9, this vulnerability is classified as High severity, reflecting the potential for significant impact on data confidentiality and integrity within the file management environment.

Immediate Action: Update all FileRise instances to version 2.7.1 or later to resolve the unsafe handling of user-uploaded files.

Proactive Monitoring: Review application access logs for unusual upload activity or frequent access to suspicious share links that might indicate an attempt to weaponize the file manager.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and block the upload of SVG or HTML files containing malicious script tags until the application can be updated.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub (https://github.com/x0root/CVE-2025-68116).

Given the availability of a public proof-of-concept and the potential for session compromise, administrators should prioritize updating to version 2.7.1 immediately. Failure to patch this vulnerability leaves the environment exposed to persistent cross-site scripting attacks that could compromise administrative or user accounts.