CVE-2026-104105: FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the target account's valid primary credential and captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes. The issue does not by itself disclose the primary credential or TOTP code. This issue is fixed in version 3.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
Which deployments are affected?
FileRise versions prior to 3.23.0 are affected. Version 3.23.0 fixes the replay condition.
What does an attacker need to exploit this?
The attacker needs the target account's valid primary credential and a TOTP code captured after that code has successfully been used. They must replay it from another pending login session before the accepted TOTP time window closes.
Can this issue alone expose passwords or TOTP codes?
No. The issue does not itself disclose the primary credential or the TOTP code; it allows replay of a captured code during its valid window.
What should be done if immediate upgrading is not possible?
The provided information does not specify a workaround. Limit exposure of primary credentials and TOTP codes, and upgrade to 3.23.0 when possible.