CVE-2026-57492: FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Instances running a FileRise version before 3.16.0 are exposed if their users.txt file becomes empty or is missing after setup has already been completed. The affected setup flow is remotely reachable without authentication.
What must happen before an attacker can create an administrator account?
The FileRise user store, users.txt, must be emptied or missing, such as through storage loss, truncation, or another failure. Once that condition occurs, an attacker can identify that setup mode has reopened and create the next initial administrator account.
Is a normal completed installation affected by default?
A completed installation is not described as reopening setup mode while users.txt remains populated. The vulnerable condition is specifically an empty or missing users.txt file, because earlier versions use that mutable file to determine whether setup has been completed.
How can administrators determine whether their instance may already be affected?
Check whether users.txt is empty or missing and whether the application presents its initial setup flow after it was previously configured. Either condition indicates that setup mode may be available for unauthenticated administrator creation.
What remediation is available?
Upgrade FileRise to version 3.16.0, which fixes the issue. The fix adds protection against relying solely on the mutable user store to determine whether setup has been completed.