CVE-2026-57492 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.
A vulnerability in FileRise, a self-hosted web-based file manager, allows for the unauthorized creation of an admin account. This issue affects versions through 3.15.0. The vulnerability arises because the application reopens its setup mode when the 'users.txt' file is empty or missing, treating it as a fresh installation. An unauthenticated user can then exploit this by triggering the setup process and creating an initial administrator account. The problem is compounded by the absence of a permanent setup completion marker that is independent of the user store, leaving the application vulnerable to exploitation after certain storage-related failures.
Users can upgrade to FileRise version 3.16.0 or later, where this vulnerability has been addressed. The update includes a mechanism to automatically create a setup-complete marker for existing installations with users, ensuring that the application does not inadvertently reopen setup mode. Instructions for upgrading can be found in the FileRise repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6 | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.16.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| error311/FileRise | <= 3.15.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |