CVE-2026-77427

Deferred Deferred - Pending Action

FileRise Credential Decryption via Legacy Key Exposure

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77427

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	>= 3.9.0, < 3.22.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

FileRise versions 3.9.0 to 3.22.0 had a flaw where manual installations without a specific encryption key could use a legacy fallback key. If attackers obtained encrypted files, they could decrypt sensitive data like TOTP secrets or credentials using this known key.

Detection Guidance

Check FileRise version for installations between 3.9.0 and 3.22.0. Verify if PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key exists. Inspect ciphertext-bearing account or configuration files for signs of decryption using known fallback keys.

Impact Analysis

If you used FileRise between versions 3.9.0 and 3.22.0 without a unique encryption key, attackers could decrypt stored credentials or TOTP secrets if they accessed encrypted files. Docker installations were not affected as they generated unique keys automatically.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) or HIPAA (health information privacy) requirements for encryption and access controls.

Mitigation Strategies

Upgrade FileRise to version 3.22.0 or later. If using Docker, ensure the persistent key is unique. For manual installations without PERSISTENT_TOKENS_KEY, generate a new persistent key and rotate existing encrypted data to prevent decryption using fallback keys.

Hi! I’m here to help you understand CVE-2026-77427. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70