CVE-2026-104105

Deferred Deferred - Pending Action

TOTP Replay Vulnerability in FileRise Prior to 3.23.0

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the target account's valid primary credential and captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes. The issue does not by itself disclose the primary credential or TOTP code. This issue is fixed in version 3.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104105

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.23.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

FileRise before version 3.23.0 has a flaw in its TOTP verification. It checks if a code is valid for the time window but does not track if the same account and time step already succeeded. This allows an attacker with a valid primary credential and a captured TOTP code to replay it in another session before the time window expires.

Detection Guidance

This vulnerability involves improper handling of TOTP codes in FileRise versions prior to 3.23.0. To detect it, check the FileRise version installed on your system. If it is below 3.23.0, the system is vulnerable. No specific commands are provided in the context to detect exploitation attempts.

Impact Analysis

An attacker could gain unauthorized access to your FileRise account by replaying a previously used but still valid TOTP code. This does not expose your primary password or TOTP secret but allows session hijacking within the valid time window.

Compliance Impact

This vulnerability does not directly disclose primary credentials or TOTP codes but allows replay of valid codes within a time window. This could potentially enable unauthorized access to sensitive data managed by FileRise, which may impact compliance with GDPR (data protection) or HIPAA (healthcare data) if such data is exposed or mishandled due to unauthorized access.

Mitigation Strategies

Update FileRise to version 3.23.0 or later to address the TOTP replay vulnerability. Monitor login attempts for suspicious activity involving repeated TOTP codes.

Hi! I’m here to help you understand CVE-2026-104105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70