PT-2026-26589 · Filerise · Filerise

N0Rv-Tvt · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-33072

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.9.0

Description FileRise is a self-hosted web file manager and WebDAV server. Versions prior to 3.9.0 utilize a hardcoded default encryption key (default please change this key) for all cryptographic operations, including HMAC token generation, AES configuration encryption, and session tokens. This allows an unauthenticated attacker to forge upload tokens, enabling arbitrary file uploads to shared folders, and to decrypt administrator configuration secrets, such as OIDC client secrets and SMTP passwords. The software uses a single key (PERSISTENT TOKENS KEY) for all cryptographic operations, and the default value is used unless explicitly overridden by the deployer through an environment variable.

Recommendations Versions prior to 3.9.0 should be updated to version 3.9.0 or later.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-1188

CWE-798

Identificadores relacionados

CVE-2026-33072

GHSA-F4XX-57CV-MG3X

Produtos afetados

Filerise

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33072.json · Exploit
• 🔥 https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x · Exploit
• https://github.com/error311/FileRise/releases/tag/v3.9.0 · Nota
• https://osv.dev/vulnerability/CVE-2026-33072 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33072 · Nota de Segurança
• https://twitter.com/CVEnew/status/2035627005622767843 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2035015635923591406 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2035114302194298912 · Publicação no Twitter