CVE-2026-57490: FileRise: WebDAV authentication bypasses TOTP/MFA entirely
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
FileRise versions before 3.16.0 are exposed when WebDAV is enabled and the targeted account has TOTP configured. The browser login path is not the affected path; the issue is in the separate WebDAV authentication callback.
What does an attacker need to exploit the issue?
An attacker needs valid username and password credentials for a TOTP-enabled FileRise account. They can then authenticate to the enabled WebDAV service using Basic authentication without providing the account's TOTP factor.
What access does successful exploitation provide?
The attacker can exercise the compromised account's WebDAV file permissions. The vulnerability does not grant permissions beyond those already assigned to that account.
What can be done if upgrading is not immediately possible?
Disable WebDAV to prevent use of the affected authentication path. Otherwise, accounts whose primary credentials may be exposed remain susceptible to WebDAV access without TOTP.
How is the issue remediated?
Upgrade FileRise to version 3.16.0, which fixes WebDAV authentication so that it enforces the configured TOTP factor.