CVE-2026-33072

FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.

• CWE-798
• CWE-1188

• https://github.com/error311/FileRise/releases/tag/v3.9.0Product, Release Notes
• https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3xExploit, Vendor Advisory
• https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3xExploit, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33067SiYuan is a personal knowledge management system. Versions 3…9
• CVE-2026-33068Claude Code is an agentic coding tool. Versions prior to 2.1…8.8
• CVE-2026-33069PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2026-3307An authorization bypass vulnerability was identified in GitH…2.7
• CVE-2026-33070FileRise is a self-hosted web file manager / WebDAV server. …4.8
• CVE-2026-33071FileRise is a self-hosted web file manager / WebDAV server. …8.8
• CVE-2026-33073Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33074Discourse is an open-source discussion platform. From versio…5.3
• CVE-2026-33075FastGPT is an AI Agent building platform. In versions 4.14.8…8.8
• CVE-2026-33076Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8
• CVE-2026-33077Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…7.5
• CVE-2026-33078Roxy-WI is a web interface for managing Haproxy, Nginx, Apac…9.8