CVE-2026-57492

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.

• CWE-306

• https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6
• https://github.com/error311/FileRise/releases/tag/v3.16.0
• https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8
• https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57487pupnp is an SDK for development of UPnP device and control p…7.5
• CVE-2026-57488pupnp is an SDK for development of UPnP device and control p…7.1
• CVE-2026-57489FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-5749Inadequate access control in the registration process in Ful…8.7
• CVE-2026-57490FileRise is a self-hosted web-based file manager with multi-…8.1
• CVE-2026-57491FileRise is a self-hosted web-based file manager with multi-…6.5
• CVE-2026-57493FileRise is a self-hosted web-based file manager with multi-…6.8
• CVE-2026-57494AgenticMail gives AI agents real email addresses and phone n…7.1
• CVE-2026-57495AgenticMail gives AI agents real email addresses and phone n…8.2
• CVE-2026-57496NetLicensing MCP Server is a natural-language interface that…9.6
• CVE-2026-57497webtransport-go is an implementation of the WebTransport pro…5.3
• CVE-2026-57498Coolify is an open-source and self-hostable tool for managin…9.6