Authentication Bypass Vulnerability in FileRise WebDAV

CVE-2026-57490

What is CVE-2026-57490?

FileRise, a self-hosted web-based file manager, has an authentication bypass vulnerability affecting its WebDAV feature. When WebDAV is enabled, the application fails to enforce the mandatory Time-based One-Time Password (TOTP) for accounts that have it enabled. Instead, it only checks the primary username and password, allowing attackers with valid primary credentials to authenticate without providing the required second factor. This flaw was addressed in version 3.16.0, which ensures that both the browser login and WebDAV authentication paths properly enforce TOTP integration.

References