CVE-2026-57490

Deferred Deferred - Pending Action

Authentication Bypass via Missing TOTP Check in FileRise WebDAV

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-57490

EUVD

EUVD-2026-101637

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-308	The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Attack-Flow Graph

Executive Summary

FileRise before version 3.16.0 has a vulnerability in its WebDAV Basic authentication. When WebDAV is enabled, the system only checks the username and password but ignores the TOTP second factor for authentication. This allows attackers with valid primary credentials to bypass TOTP and access WebDAV services with the account's permissions.

Detection Guidance

Check if WebDAV is enabled in FileRise by inspecting the configuration files for the webdav.php endpoint. Verify if TOTP is enforced for WebDAV authentication by comparing browser login and WebDAV authentication paths. Look for failed authentication attempts in logs where TOTP-enabled accounts authenticated without the second factor.

Impact Analysis

If you use FileRise with WebDAV enabled and TOTP protection on accounts, an attacker could gain unauthorized access to files by exploiting this flaw. They could read, modify, or delete files within the account's WebDAV permissions without needing the second factor.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. It undermines multi-factor authentication controls, potentially resulting in non-compliance with data protection standards that mandate strong authentication.

Mitigation Strategies

Upgrade FileRise to version 3.16.0 or later to address the authentication bypass. If upgrading is not immediately possible, disable WebDAV in FileRise until the update is applied. Review and enforce TOTP requirements for all accounts accessing WebDAV services.

Hi! I’m here to help you understand CVE-2026-57490. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70