Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M

CVE-2026-77427FileRise: Insecure default cryptographic key fallback in manual installs

Medium 5.9

In plain English

A medium-severity hard-coded credentials in FileRise from error311. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 71.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.

Affected products (as reported)

Vendor	Product	Versions
error311	FileRise	>= 3.9.0, < 3.22.0

Weakness: CWE-798, CWE-1188 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/error311/FileRise/security/advisories/GHSA-g6p5-9cpq-mp5h x_refsource_CONFIRM
https://github.com/error311/FileRise/commit/b5213b66d4c668a45f1b7600aa62b79cb66ddbe6 x_refsource_MISC
https://github.com/error311/FileRise/releases/tag/v3.22.0 x_refsource_MISC