CVE-2026-57490

HIGH 8.1

FileRise: WebDAV authentication bypasses TOTP/MFA entirely

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.

CWE	CWE-308
Vendor	error311
Product	filerise
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for error311 filerise

Be the first to know when new high vulnerabilities affecting error311 filerise are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

error311 / FileRise

< 3.16.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/error311/FileRise/security/advisories/GHSA-cx7g-xhj8-8cx3 github.com: https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6 github.com: https://github.com/error311/FileRise/releases/tag/v3.16.0