CVE-2026-33072: FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (defaultpleasechangethiskey) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENTTOKENSKEY) for all crypto operations. The default value defaultpleasechangethiskey is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33072?
CVE-2026-33072 has a high severity rating due to the potential for token forgery and config decryption.
How do I fix CVE-2026-33072?
To fix CVE-2026-33072, upgrade FileRise to version 3.9.0 or later where the hardcoded encryption key has been removed.
What versions of FileRise are affected by CVE-2026-33072?
Versions of FileRise prior to 3.9.0 are affected by CVE-2026-33072 due to the use of a hardcoded default encryption key.
How can CVE-2026-33072 impact my FileRise deployment?
CVE-2026-33072 can allow attackers to forge tokens and decrypt configurations, compromising the security of your FileRise deployment.
Is there a workaround for CVE-2026-33072?
There is no effective workaround for CVE-2026-33072; the only solution is to update to the latest version.