CSRF Vulnerability in FileRise File Manager by Error311

CVE-2026-104106

What is CVE-2026-104106?

FileRise, a self-hosted web-based file manager, contains a vulnerability that allows an authenticated session with a valid CSRF token to disable Time-based One-Time Password (TOTP) without requiring recent full reauthentication. This flaw enables an attacker with control over an existing authenticated session to manipulate TOTP settings, thereby disabling the second-factor authentication or enrolling a new TOTP secret when one is not configured. The vulnerability is addressed in version 3.23.0, which resolves the issues related to TOTP security and session management.

References