CVE-2026-57489: FileRise: AUTH_BYPASS reverse-proxy header trust without source IP validation enables full authentication bypass
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTHBYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FRTRUSTEDPROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend. This issue is fixed in version 3.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only deployments with AUTH_BYPASS enabled are affected, and only when an untrusted path can reach the backend application port directly. Deployments that do not use proxy-header authentication are not described as affected.
What does an attacker need to exploit the vulnerability?
An attacker needs network access to the backend application port through a path that is not a trusted reverse proxy. No credentials, password, or MFA interaction is required; the attacker can provide an X-Remote-User header asserting the target account.
What is the potential impact of successful exploitation?
The attacker can obtain a session for the account named in X-Remote-User, including an administrator account. This can result in full authentication bypass with high confidentiality, integrity, and availability impact.
How can exposure be reduced before upgrading?
Prevent direct or otherwise untrusted access to the backend application port, so requests can reach it only through trusted reverse proxies. If proxy-header authentication is not required, disable AUTH_BYPASS.
What version contains the fix?
The issue is fixed in FileRise version 3.16.0. Versions prior to 3.16.0 are affected only under the described AUTH_BYPASS and backend-exposure conditions.