CVE-2026-77427 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.
A vulnerability exists in FileRise, a self-hosted web-based file manager, regarding the management of cryptographic keys in manual installations. Versions 3.9.0 prior to 3.22.0 are affected. The issue arises because these installations do not automatically generate a persistent tokens key, leaving them to rely on a published legacy fallback key. This fallback key can be exploited to decrypt sensitive information, such as TOTP secrets and admin credentials, if an attacker has access to certain ciphertext-bearing files. The vulnerability is not present in Docker installations, which automatically generate a unique key.
Users should upgrade to FileRise version 3.22.0, which addresses this vulnerability by ensuring that manual installations generate and persist a unique cryptographic key. Existing installations should use the Admin Panel's controlled rotation workflow to update their key.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-g6p5-9cpq-mp5h | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/error311/FileRise/commit/b5213b66d4c668a45f1b7600aa62b79cb66ddbe6 | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.22.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-g6p5-9cpq-mp5h | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-798 | Use of Hard-coded Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileRise | >= 3.9.0, <= 3.21.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |