CVE-2026-77427

MEDIUM 5.9

FileRise: Insecure default cryptographic key fallback in manual installs

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.

CWE	CWE-798 CWE-1188
Vendor	error311
Product	filerise
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for error311 filerise

Be the first to know when new medium vulnerabilities affecting error311 filerise are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

error311 / FileRise

>= 3.9.0, < 3.22.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/error311/FileRise/security/advisories/GHSA-g6p5-9cpq-mp5h github.com: https://github.com/error311/FileRise/commit/b5213b66d4c668a45f1b7600aa62b79cb66ddbe6 github.com: https://github.com/error311/FileRise/releases/tag/v3.22.0