An unauthenticated file read vulnerability in FileRise versions prior to 3.3.0 poses a significant risk of sensitive data exposure.

The application fails to enforce access control on the /uploads directory, allowing any unauthenticated remote user to read stored files by guessing or knowing the file path. This flaw stems from improper access control mechanisms.

Successful exploitation of this vulnerability allows unauthorized actors to access potentially sensitive information stored within the FileRise upload directory. Given the CVSS score of 7.5, this is considered a high-severity issue that could lead to significant privacy breaches and the exposure of proprietary or confidential data.

Immediate Action: Update FileRise to version 3.3.0 or later to apply the necessary access control restrictions.

Proactive Monitoring: Review web access logs for unusual patterns of requests directed at the /uploads directory from unauthorized IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict direct access to the /uploads directory and block unauthorized directory traversal or file retrieval attempts.

Public Exploit Available: Unknown (A Nuclei detection template exists, but there is no evidence of a weaponized exploit or public proof-of-concept).

This vulnerability represents a significant security oversight that exposes stored data to the public internet. Organizations currently running FileRise must prioritize the upgrade to version 3.3.0 immediately to remediate the access control flaw and prevent potential data exfiltration.