CVE-2026-77427: FileRise: Insecure default cryptographic key fallback in manual installs
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENTTOKENSKEY or metadata/persistenttokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.22.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are pristine manual installations from 3.9.0 through 3.22.0 that lack both PERSISTENT_TOKENS_KEY and metadata/persistent_tokens.key. Docker installations are not affected because they already generated a unique persistent key.
What must an attacker obtain to exploit this issue?
An attacker must separately obtain ciphertext-bearing account or configuration files. The published legacy compatibility key can then be used to decrypt protected TOTP secrets or credentials.
How can I determine whether an installation may be using the fallback key?
Check whether the installation was a pristine manual deployment in the affected version range and whether PERSISTENT_TOKENS_KEY and metadata/persistent_tokens.key are both absent. Existing installations are not automatically rotated, because rotation could make encrypted state unreadable.
What version contains the fix?
The issue is fixed in FileRise version 3.22.0.