FileRise Vulnerability in Self-Hosted Web-Based File Manager
CVE-2026-77427

5.9MEDIUM

Key Information:

Vendor

Error311

Status
Filerise
Vendor
CVE Published:
14 October 2026

What is CVE-2026-77427?

The vulnerability in FileRise allows an attacker to exploit installations from version 3.9.0 to 3.22.0 without a defined PERSISTENT_TOKENS_KEY. By compromising ciphertext-bearing files, the known fallback key could facilitate the decryption of Two-Factor Authentication (TOTP) secrets or user credentials. This issue highlights the importance of using unique persistent keys and properly rotating them in installations to safeguard against unauthorized access and maintain the integrity of sensitive data. Users should upgrade to version 3.22.0 promptly to mitigate this risk.

Affected Version(s)

FileRise >= 3.9.0, < 3.22.0

References

https://github.com/error311/FileRise/security/advisories/...
x_refsource_CONFIRM
https://github.com/error311/FileRise/commit/b5213b66d4c66...
x_refsource_MISC
https://github.com/error311/FileRise/releases/tag/v3.22.0
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.