CVE-2026-103977: FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have a target account's valid primary credential. They can then repeatedly restart the login workflow in new sessions to regain the TOTP attempt allowance and continue guessing verification codes.
Are deployments affected by default?
Affected deployments are those running a FileRise version earlier than 3.23.0 where TOTP verification is used. The issue is in the pending-login TOTP handling, which tracks failed attempts only within the current session.
What should be done if patching is not immediately possible?
The provided information does not describe a workaround. Limit exposure of valid primary credentials and monitor for repeated login workflows or failed TOTP verification activity where possible.
How is this fixed?
Upgrade FileRise to version 3.23.0. The fix addresses the lack of a durable account-wide limit for pending-login TOTP verification attempts.