Vulnerability Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG uploads without sanitizing or restricting embedded script content. When a malicious SVG containing inline JavaScript or event-based payloads is uploaded, it is later rendered directly in the browser whenever viewed within the application. Because SVGs are XML-based and allow scripting, they execute in the origin context of the application, enabling full stored XSS. This vulnerability is fixed in 2.2.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Filerise | Filerise | < 2.2.3 |
Related Weaknesses (CWE)
References
- https://github.com/error311/FileRise/commit/f2ce43f18f0444f8f63f7c33758d1837dd5bPatch
- https://github.com/error311/FileRise/security/advisories/GHSA-qrcv-vjvf-fr29Vendor AdvisoryExploit
FAQ
What is CVE-2025-66403?
CVE-2025-66403 is a vulnerability with a CVSS score of 4.6 (MEDIUM). FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vulnerability exists in the Filerise applica...
How severe is CVE-2025-66403?
CVE-2025-66403 has been rated MEDIUM with a CVSS base score of 4.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-66403?
Check the references section above for vendor advisories and patch information. Affected products include: Filerise Filerise.