PT-2026-26589 · Filerise · Filerise

N0Rv-Tvt · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-33072

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.9.0

Description FileRise is a self-hosted web file manager and WebDAV server. Versions prior to 3.9.0 utilize a hardcoded default encryption key (default please change this key) for all cryptographic operations, including HMAC token generation, AES configuration encryption, and session tokens. This allows an unauthenticated attacker to forge upload tokens, enabling arbitrary file uploads to shared folders, and to decrypt administrator configuration secrets, such as OIDC client secrets and SMTP passwords. The software uses a single key (PERSISTENT TOKENS KEY) for all cryptographic operations, and the default value is used unless explicitly overridden by the deployer through an environment variable.

Recommendations Versions prior to 3.9.0 should be updated to version 3.9.0 or later.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-1188

CWE-798

Related Identifiers

CVE-2026-33072

GHSA-F4XX-57CV-MG3X

Affected Products

Filerise

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33072.json · Exploit
• 🔥 https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x · Exploit
• https://osv.dev/vulnerability/CVE-2026-33072 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33072 · Security Note
• https://github.com/error311/FileRise/releases/tag/v3.9.0 · Note
• https://twitter.com/CVEnew/status/2035627005622767843 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2035015635923591406 · Twitter Post
• https://twitter.com/TheHackerWire/status/2035114302194298912 · Twitter Post