CVE-2026-57492GHSA-g555-3rg9-wrq8
FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
error311 FileRise
CVSS
7.4HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 15 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.27%Chance of exploitation activity in the next 30 days, higher than 18% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.16.0error311/FileRiseGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.
Text from CVE List
Affected versions 2
- FileRiseaffected: < 3.16.0CVE List
- error311/FileRise≤ 3.15.0GitHub