CVE-2026-57490
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch…
- Risk score
- 56/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's c…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.16.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.
Last activity 14 Oct 2026. Patch Forecast updates every hour.