All vulnerabilities
CVE-2026-57490GHSA-cx7g-xhj8-8cx3

FileRise: WebDAV authentication bypasses TOTP/MFA entirely

error311 FileRise
Open in ThreatlineRecord JSON
CVSS
8.1High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.41%Chance of exploitation activity in the next 30 days, higher than 34% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.16.0Fixed versionGitHub
Published14 Oct 2026Updated 15 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.

Text from CVE List

Affected versions 2

  • FileRiseaffected: < 3.16.0CVE List
  • error311/FileRise≤ 3.15.0GitHub

References 3