CVE-2026-103977 Details

A vulnerability in FileRise, a self-hosted web-based file manager, prior to version 3.23.0, allows for excessive TOTP verification attempts. The application stored failed TOTP attempts in the PHP session, creating a session-scoped limit that could be bypassed. An attacker with valid primary credentials could exploit this by restarting the login process in a new session, effectively resetting the TOTP attempt allowance and continuing to guess TOTP codes beyond the intended limit. This issue has been classified as CWE-307: Improper Restriction of Excessive Authentication Attempts.

Users are advised to upgrade to FileRise version 3.23.0 or later, which implements centralized persistent TOTP attempt limiting across all pending-login verification paths. The new system enforces an account-wide limit of five attempts per 15-minute window, which persists across sessions and client address changes. Successful TOTP verifications clear the attempt budget, and the application now correctly handles TOTP enrollments and verifications.