{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33072", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T19:27:06.344Z", "datePublished": "2026-03-20T08:31:08.452Z", "dateUpdated": "2026-03-20T08:31:08.452Z"}, "containers": {"cna": {"title": "FileRise: Default Encryption Key Enables Token Forgery and Config Decryption", "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "lang": "en", "description": "CWE-798: Use of Hard-coded Credentials", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1188", "lang": "en", "description": "CWE-1188: Insecure Default Initialization of Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x"}, {"name": "https://github.com/error311/FileRise/releases/tag/v3.9.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/error311/FileRise/releases/tag/v3.9.0"}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"version": "< 3.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T08:31:08.452Z"}, "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations \u2014 HMAC token generation, AES config encryption, and session tokens \u2014 allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0."}], "source": {"advisory": "GHSA-f4xx-57cv-mg3x", "discovery": "UNKNOWN"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations \u2014 HMAC token generation, AES config encryption, and session tokens \u2014 allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0."}], "id": "CVE-2026-33072", "lastModified": "2026-03-20T09:16:15.710", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-03-20T09:16:15.710", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/error311/FileRise/releases/tag/v3.9.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}, {"lang": "en", "value": "CWE-1188"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-03-20T09:20:52.545042+00:00", "value": {"mitigation_remediation": ["Upgrade to FileRise v3.9.0 or later. If upgrade not possible, change the environment variable PERSISTENT_TOKENS_KEY to a strong, unique key before starting the service."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Data Upload and Configuration Secrets Exposure"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all FileRise deployments with versions prior to 3.9.0. Vendors or users running FileRise 3.8.x or earlier are impacted.", "description_and_impact": "FileRise uses the same hardcoded key (default_please_change_this_key) for HMAC token creation, AES configuration encryption, and session tokens. This key is used unless overridden by the PERSISTENT_TOKENS_KEY environment variable. As a result, any unauthenticated attacker can forge upload tokens and perform arbitrary file uploads to shared folders, and can decrypt administrative configuration secrets such as OIDC client credentials and SMTP passwords. The vulnerability exposes confidential data and allows unauthorized data manipulation.", "risk_and_exploitability": "The CVSS score is 8.2, indicating high severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers require no authentication; any network user can submit forged tokens and read decrypted configurations. The critical nature of the exposed credentials makes this a high-risk issue for organizations using FileRise."}}}}, "created": "2026-03-20T10:36:32.012425+00:00", "updated": "2026-03-20T10:36:32.012452+00:00", "vendors": []}