CVE-2026-104105GHSA-9pg4-98cx-r82j
FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
error311 FileRise
CVSS
6.4MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.23.0FileRiseGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the target account's valid primary credential and captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes. The issue does not by itself disclose the primary credential or TOTP code. This issue is fixed in version 3.23.0.
Text from CVE List
Affected versions 2
- FileRiseaffected: < 3.23.0CVE List
- FileRise<= 3.22.0GitHub