FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials.
Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
error311:filerise
References 3
https://github.com/error311/FileRise/security/advisories/GHSA-g6p5-9cpq-mp5h
https://github.com/error311/FileRise/security/advisories/GHSA-g6p5-9cpq-mp5h
https://github.com/error311/FileRise/commit/b5213b66d4c668a45f1b7600aa62b79cb66…
https://github.com/error311/FileRise/commit/b5213b66d4c668a45f1b7600aa62b79cb66ddbe6
https://github.com/error311/FileRise/releases/tag/v3.22.0
https://github.com/error311/FileRise/releases/tag/v3.22.0