CVE-2026-57489
8.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-290
Impact
Unauthenticated attackers can hijack any account, including administrators, bypassing passwords and MFA entirely. To exploit this, they need direct network access to the FileRise backend port on deployments with AUTH_BYPASS enabled.
Root cause
The application trusts the X-Remote-User proxy authentication header without checking if the request came from an IP defined in FR_TRUSTED_PROXIES.
Affected systems
FileRise prior to version 3.16.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade FileRise to version 3.16.0 or higher. If you cannot upgrade immediately, block direct network access to the FileRise backend port using firewall rules or temporarily set AUTH_BYPASS to false.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend. This issue is fixed in version 3.16.0.