CVE-2026-57490
8.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-308
Impact
Attackers with stolen user credentials can bypass TOTP and access or modify files over WebDAV. They only need valid primary credentials and network access to an instance with WebDAV enabled.
Root cause
The WebDAV endpoint in public/webdav.php validates only username and password via AuthModel::authenticate() and omits TOTP enforcement.
Affected systems
FileRise prior to 3.16.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade FileRise to version 3.16.0 or higher. If patching must wait, disable the WebDAV feature in the administrator settings.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.