CVE-2026-33072

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/error311/FileRise/releases/tag/v3.9.0	Product Release Notes
https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x	Exploit Vendor Advisory
https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-03-20 09:16

Updated : 2026-03-23 15:53

NVD link : CVE-2026-33072

Mitre link : CVE-2026-33072

CVE.ORG link : CVE-2026-33072

JSON object : View

Products Affected

filerise

filerise

CWE

CWE-798

Use of Hard-coded Credentials

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2026-33072", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-20T09:16:15.710", "references": [{"url": "https://github.com/error311/FileRise/releases/tag/v3.9.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-798"}, {"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations \u2014 HMAC token generation, AES config encryption, and session tokens \u2014 allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0."}, {"lang": "es", "value": "FileRise es un gestor de archivos web autoalojado / servidor WebDAV. En versiones anteriores a la 3.9.0, se utiliza una clave de cifrado predeterminada codificada de forma r\u00edgida (default_please_change_this_key) para todas las operaciones criptogr\u00e1ficas \u2014 generaci\u00f3n de tokens HMAC, cifrado de configuraci\u00f3n AES y tokens de sesi\u00f3n \u2014 permitiendo a cualquier atacante no autenticado forjar tokens de carga para la subida arbitraria de archivos a carpetas compartidas, y descifrar secretos de configuraci\u00f3n de administrador, incluidos secretos de cliente OIDC y contrase\u00f1as SMTP. FileRise usa una \u00fanica clave (PERSISTENT_TOKENS_KEY) para todas las operaciones criptogr\u00e1ficas. El valor predeterminado default_please_change_this_key est\u00e1 codificado de forma r\u00edgida en dos lugares y se utiliza a menos que el implementador anule expl\u00edcitamente la variable de entorno. Este problema est\u00e1 solucionado en la versi\u00f3n 3.9.0."}], "lastModified": "2026-03-23T15:53:41.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB279A4C-FE56-4D97-9D52-6C316C1B3266", "versionEndExcluding": "3.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}