CVE-2026-33072 Details
Description
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.
A vulnerability exists in FileRise, a self-hosted web file manager and WebDAV server, in versions prior to 3.9.0. The issue arises from a hardcoded default encryption key, 'default_please_change_this_key', used for all cryptographic operations, including HMAC token generation, AES configuration encryption, and session tokens. This flaw enables any unauthenticated attacker to forge upload tokens for arbitrary file uploads to shared folders and decrypt admin configuration secrets, such as OIDC client secrets and SMTP passwords. The vulnerability is present because FileRise uses a single key, 'PERSISTENT_TOKENS_KEY', for all cryptographic operations, with the default value hardcoded in the Dockerfile and config files. Unless the deployer explicitly changes the key, the default is used, leaving the application vulnerable.
Users can upgrade to FileRise version 3.9.0 or later, where this vulnerability has been fixed. Instructions for updating are available in the FileRise documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x | CISA-ADP | ExploitVendor Advisory |
| https://github.com/error311/FileRise/releases/tag/v3.9.0 | [email protected] | ProductRelease Notes |
| https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| filerise filerise | < 3.9.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |