FileRise

v3.18.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo File Storage & Sync

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

acl docker file-editor file-manager file-upload folder-management

+11 more

javascript multi-file-upload php self-hosted sso twofactor-auth unraid uploader web web-based webdav

Affected surfaces

auth rbac

Summary

AI summary

Updates v3.18.0, upload, and metadata across a mixed release.

Full changelog

Changes 06/23/2026 (v3.18.0)

release(v3.18.0): file operation hardening

Commit message

release(v3.18.0): file operation hardening

- security(upload): reject shared-upload filename collisions and require edit authority for replacements
- security(metadata): use collision-resistant folder metadata filenames

Fixed

Upload overwrite hardening
- Public shared-folder and portal uploads are now create-only when the destination filename already exists.
- Authenticated uploads now require edit authority plus ownership, folder ownership, admin, or bypass ownership before replacing an existing file.
- Upload collision errors preserve the original file content and return an explicit conflict/permission response.
Folder metadata isolation hardening
- Folder metadata filenames now preserve distinct logical folder paths instead of flattening separators and spaces into the same name.
- Ownership and read_own checks now resolve metadata from the same isolated path used by uploads, file operations, WebDAV, and background transfer handling.
- Simple non-colliding folder metadata filenames remain compatible; existing metadata for collision-prone folders is copied into the isolated filename on first access.

v3.18.0

Full Changelog

v3.17.0 → v3.18.0

SHA-256 (zip)

cf024445b2fad4074b63ede97a6282765016a83c3a6d8ca3aeb62441d8b1db5e  FileRise-v3.18.0.zip

Breaking Changes

Public shared-folder and portal uploads are create‑only when the destination filename already exists; authenticated uploads now require edit authority plus ownership, folder ownership, admin, or bypass before replacing a file.

Security Fixes

Upload collisions are rejected for public/shared folders; authenticated replacements demand explicit edit authority.
Folder metadata filenames use collision‑resistant naming preserving logical paths and enforce per‑path ownership checks.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track FileRise

Get notified when new releases ship.

About FileRise

FileRise – lightweight, self-hosted file manager & storage hub with granular ACLs, resumable uploads, encrypted folders, WebDAV & SSO. Fully Docker / Unraid compatible.

All releases →