CVE-2026-57489 Details

An authentication bypass vulnerability has been identified in FileRise, a self-hosted web-based file manager. This issue affects versions through 3.15.0, specifically in deployments where the AUTH_BYPASS feature is enabled. The vulnerability arises because the application trusts the reverse proxy identity header (defaulting to X-Remote-User) without verifying the request's origin against the FR_TRUSTED_PROXIES setting. When the backend application port is directly accessible, an unauthenticated attacker can manipulate the identity header to gain access to the associated user session, including that of an administrator, without needing a password or multi-factor authentication. The flaw is particularly concerning in default Docker deployments, where the application port is exposed to the local network.

Users should upgrade to FileRise version 3.16.0 or later, and those using proxy-header login must set the FR_TRUSTED_PROXIES variable to the reverse proxy IP or CIDR before upgrading. Direct access to the application backend should also be blocked at the network or proxy layer.