Read the docs
TI-2026-25514 Aliases CVE-2026-33072

FileRise: Default Encryption Key Enables Token Forgery and Config Decryption

Priority HIGH 75CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00229 13th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed FileRise (error311): 3.9.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
error311FileRisebefore 3.9.03.9.0Patch availableCNA
  • FileRise Vendorerror311 Affected before 3.9.0 Fixed in 3.9.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*before 3.9.0Vulnerableerror311
  • cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:* Versions before 3.9.0 Vulnerable ·error311

Remediation

  • Fix · CNA FileRise (error311) Fixed in 3.9.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33072

References

Exploit 1

Other 1

  • TI-2025-41705 FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling CVSS 3.1HIGH 8.9
  • TI-2026-25513 FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads CVSS 3.1HIGH 8.8
  • TI-2026-25739 Path traversal in error311 FileRise CVSS 3.1HIGH 8.1
  • TI-2026-25740 FileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callback CVSS 3.1HIGH 7.1
  • TI-2026-25512 FileRise has Unauthenticated Share Link Deletion CVSS 3.1MEDIUM 4.8
  • TI-2026-25873 FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content CVSS 3.1MEDIUM 4.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences