Authentication Bypass in FileRise File Manager Software

CVE-2026-104105

What is CVE-2026-104105?

FileRise is a self-hosted web-based file management solution that allows users to perform multi-file uploads, editing, and batch operations. A security flaw existed in versions before 3.23.0, where the application verified the validity of a Time-based One-Time Password (TOTP) code within an acceptable time frame but failed to track if the same account and time step had already been successfully utilized. This oversight allows attackers with access to the account's valid primary credentials to exploit a TOTP code captured after its initial use. An attacker could replay this code from a different login session before the assigned time window expires, potentially compromising the account. The issue has been addressed in version 3.23.0, which includes the necessary safeguards against this replay attack.

References