CVE-2026-57490

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.

• CWE-308

• https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6
• https://github.com/error311/FileRise/releases/tag/v3.16.0
• https://github.com/error311/FileRise/security/advisories/GHSA-cx7g-xhj8-8cx3
• https://github.com/error311/FileRise/security/advisories/GHSA-cx7g-xhj8-8cx3

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57485Stirling-PDF is a locally hosted web application that facili…8.5
• CVE-2026-57486pupnp is an SDK for development of UPnP device and control p…7.5
• CVE-2026-57487pupnp is an SDK for development of UPnP device and control p…7.5
• CVE-2026-57488pupnp is an SDK for development of UPnP device and control p…7.1
• CVE-2026-57489FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-5749Inadequate access control in the registration process in Ful…8.7
• CVE-2026-57491FileRise is a self-hosted web-based file manager with multi-…6.5
• CVE-2026-57492FileRise is a self-hosted web-based file manager with multi-…7.4
• CVE-2026-57493FileRise is a self-hosted web-based file manager with multi-…6.8
• CVE-2026-57494AgenticMail gives AI agents real email addresses and phone n…7.1
• CVE-2026-57495AgenticMail gives AI agents real email addresses and phone n…8.2
• CVE-2026-57496NetLicensing MCP Server is a natural-language interface that…9.6