CVE-2026-57490 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.
A vulnerability in FileRise WebDAV authentication prior to version 3.16.0 allows users with TOTP-enabled accounts to authenticate using only their password, bypassing the second factor entirely. This issue arises because the WebDAV authentication callback does not enforce TOTP verification, unlike the web interface which correctly implements it. As a result, an attacker with knowledge of the user's password can gain unauthorized access to the user's WebDAV file permissions and files.
Users can upgrade to FileRise version 3.16.0, which blocks password-only WebDAV login for TOTP-enabled accounts. Until this version is applied, TOTP-enabled users should refrain from using WebDAV.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-cx7g-xhj8-8cx3 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6 | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.16.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-cx7g-xhj8-8cx3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-308 | Use of Single-factor Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileRise | <= 3.15.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |