CVE-2026-57492
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch…
- Risk score
- 53/100
- CVSS
- 7.4 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthent…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.16.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.4 high
- Remotely exploitable without logging in
References
Original description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.
Last activity 14 Oct 2026. Patch Forecast updates every hour.