CVE-2026-33072— FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-33072
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FileRise: Default Encryption Key Enables Token Forgery and Config Decryption
Source: NVD (National Vulnerability Database)
Vulnerability Description
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的凭证
Source: NVD (National Vulnerability Database)
Vulnerability Title
FileRise 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FileRise是Ryan个人开发者的一个轻量级、自托管的基于web的文件管理器。 FileRise 3.9.0之前版本存在安全漏洞，该漏洞源于使用硬编码默认加密密钥，可能导致未经验证的攻击者伪造上传令牌并解密管理员配置机密。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-33072
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33072
请登录查看更多情报信息。
- Release v3.9.0 · error311/FileRise · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-33072
Same Patch Batch · error311 · 2026-03-20 · 3 CVEs total
| CVE-2026-33071 | 4.3 MEDIUM | FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads |
| CVE-2026-33070 | 3.7 LOW | FileRise has Unauthenticated Share Link Deletion |
IV. Related Vulnerabilities
Same product: FileRise
- CVE-2026-33477
FileRise has incorrect authorization in /api/file/snippet.ph - CVE-2026-33330
FileRise ONLYOFFICE integration allows read-only users to ov - CVE-2026-33329
FileRise: Path Traversal in `resumableIdentifier` Leading to - CVE-2026-33071
FileRise: WebDAV upload path bypasses filename validation en - CVE-2026-33070
FileRise has Unauthenticated Share Link Deletion
Same vendor: error311
- CVE-2026-33477
FileRise has incorrect authorization in /api/file/snippet.ph - CVE-2026-33330
FileRise ONLYOFFICE integration allows read-only users to ov - CVE-2026-33329
FileRise: Path Traversal in `resumableIdentifier` Leading to - CVE-2026-33071
FileRise: WebDAV upload path bypasses filename validation en - CVE-2026-33070
FileRise has Unauthenticated Share Link Deletion
Same weakness: CWE-798
- CVE-2026-7414
Hardcoded credentials in Yarbo robot firmware - CVE-2026-8032
PicoTronica e-Clinic Healthcare System ECHS echs.js hard-cod - CVE-2026-32834
Easy PayPal Events & Tickets 1.3 Authentication Bypass via Q - CVE-2026-42376
D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials - CVE-2026-42375
D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials
V. Comments for CVE-2026-33072
No comments yet