FileRise Vulnerability in Web-based File Management Software

CVE-2026-57492

What is CVE-2026-57492?

FileRise, a self-hosted web-based file management solution, suffers from a flaw that permits unauthorized account creation due to improper handling of the users.txt file. In versions prior to 3.16.0, the software mistakenly treats an incomplete or missing users.txt file as a new installation. Consequently, if the underlying storage encounters issues such as truncation or loss, an attacker can exploit the situation by reinitiating the setup process without authentication. This vulnerability reveals that the application lacks a stable marker to indicate completed setup independent of the user data storage, opening the door for potential security breaches. The issue has been resolved in version 3.16.0.

References