CVE-2026-57492
HIGH 7.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.
Severe if exploited (CVSS 7.4), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.3%chance of exploitation in 30 days · 28th percentile
Impact if exploited
7.4CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-306: : Missing Authentication for Critical Function
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References and research data (JSON)
All CVSS metrics
- HIGH 7.4 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - HIGH 7.4 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Exploit-tagged references (not proof of a PoC)
- https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8 CVE record · GitHub_M · Updated 2026-10-14T20:21:15.070Z
CVE record · CISA-ADP · Updated 2026-10-15T15:29:11.267Z
NVD · CVE-2026-57492 · Updated 2026-10-15T16:18:17.787
Advisories
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-101664 EUVD · EUVD-2026-101664
Technical & other
- https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6 CVE record · GitHub_M · Updated 2026-10-14T20:21:15.070Z
NVD · CVE-2026-57492 · Updated 2026-10-15T16:18:17.787 - https://github.com/error311/FileRise/releases/tag/v3.16.0 CVE record · GitHub_M · Updated 2026-10-14T20:21:15.070Z
NVD · CVE-2026-57492 · Updated 2026-10-15T16:18:17.787