FileRise is a self-hosted web file manager / WebDAV server. Prior to version 3.10.0, a broken access control issue in FileRise's ONLYOFFICE integration allows a…

A broken access control vulnerability in FileRise's ONLYOFFICE integration allows authenticated users with read-only permissions to escalate privileges and overwrite files. The vulnerability exists in FileRise versions prior to 3.10.0, where users can obtain signed save callback URLs and forge ONLYOFFICE save callbacks to write attacker-controlled content. FileRise is a self-hosted web file manager and WebDAV server. The issue has been patched in version 3.10.0.