PT-2026-26589 · Error311 · Filerise

Published 2026-03-20 · Updated 2026-03-20 · CVE-2026-33072

NVD

CVSS v3.1

8.2

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default please change this key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT TOKENS KEY) for all crypto operations. The default value default please change this key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-1188

Related Identifiers

CVE-2026-33072

Affected Products

Filerise

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33072 · Security Note
• https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x · Note
• https://github.com/error311/FileRise/releases/tag/v3.9.0 · Note