CVE-2026-33072: Filerise Auth Bypass Vulnerability

CVE-2026-33072 Overview

CVE-2026-33072 is a hardcoded credentials vulnerability affecting FileRise, a self-hosted web file manager and WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations including HMAC token generation, AES config encryption, and session tokens. This critical security flaw allows unauthenticated attackers to forge upload tokens for arbitrary file upload to shared folders and decrypt admin configuration secrets including OIDC client secrets and SMTP passwords.

Critical Impact

Unauthenticated attackers can forge upload tokens for arbitrary file uploads and decrypt sensitive administrative configuration secrets including OIDC client secrets and SMTP passwords.

Affected Products

• FileRise versions prior to 3.9.0
• FileRise self-hosted web file manager deployments using default configuration
• FileRise WebDAV server instances without custom PERSISTENT_TOKENS_KEY environment variable

Discovery Timeline

• 2026-03-20 - CVE-2026-33072 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33072

Vulnerability Analysis

This vulnerability stems from the use of a hardcoded cryptographic key for all security-critical operations within FileRise. The application uses a single key (PERSISTENT_TOKENS_KEY) for multiple cryptographic functions including HMAC token generation, AES configuration encryption, and session token creation. The default value default_please_change_this_key is hardcoded in two separate locations within the codebase and remains active unless the deployer explicitly overrides it via an environment variable.

The vulnerability is exploitable over the network without any authentication or user interaction, making it particularly dangerous for internet-facing deployments. An attacker with knowledge of the default key can forge valid upload tokens, enabling arbitrary file uploads to shared folders. Additionally, the same key is used to encrypt sensitive configuration data, meaning attackers can decrypt administrative secrets such as OIDC client secrets and SMTP passwords.

Root Cause

The root cause is CWE-798: Use of Hard-coded Credentials. FileRise embeds the default encryption key default_please_change_this_key directly in the source code in two locations. The application relies on administrators to manually override this value through environment variables, but many deployments use the insecure default configuration. This design violates cryptographic best practices that mandate unique, randomly generated keys for each deployment.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Using the publicly known default key default_please_change_this_key to generate valid HMAC tokens
2. Crafting upload tokens that appear legitimate to the FileRise server
3. Uploading arbitrary files to shared folders, potentially including malicious payloads
4. Decrypting configuration files to extract OIDC client secrets, SMTP passwords, and other sensitive data

The vulnerability manifests in the token generation and configuration encryption mechanisms. Since the default key is publicly known and documented, any attacker can leverage it against unpatched or misconfigured FileRise instances. For detailed technical analysis, see the GitHub Security Advisory GHSA-f4xx-57cv-mg3x.

Detection Methods for CVE-2026-33072

Indicators of Compromise

• Unexpected files appearing in shared folders that were not uploaded by authorized users
• Authentication or session tokens that validate successfully despite not originating from legitimate user sessions
• Unauthorized access to administrative configuration data or settings
• SMTP or OIDC authentication failures following potential credential compromise

Detection Strategies

• Monitor FileRise logs for upload activities from unrecognized sources or IP addresses
• Implement file integrity monitoring on shared folder directories to detect unauthorized uploads
• Review configuration files for signs of unauthorized access or credential extraction attempts
• Audit environment variable configurations to verify PERSISTENT_TOKENS_KEY is not using the default value

Monitoring Recommendations

• Enable verbose logging for all file upload operations and token validation events
• Set up alerts for configuration file access attempts outside normal administrative operations
• Monitor network traffic for patterns consistent with token forgery or brute-force attacks
• Implement real-time file system monitoring on shared folders to detect malicious file uploads

How to Mitigate CVE-2026-33072

Immediate Actions Required

• Upgrade FileRise to version 3.9.0 or later immediately
• Set a unique, cryptographically strong value for the PERSISTENT_TOKENS_KEY environment variable
• Rotate all OIDC client secrets and SMTP passwords that may have been exposed
• Audit shared folders for any unauthorized file uploads and remove suspicious files

Patch Information

FileRise version 3.9.0 addresses this vulnerability by implementing proper key management. Organizations should upgrade immediately by downloading the patched version from the FileRise v3.9.0 Release. After upgrading, verify that the PERSISTENT_TOKENS_KEY environment variable is set to a unique, strong cryptographic key.

Workarounds

• Set the PERSISTENT_TOKENS_KEY environment variable to a unique, randomly generated 32+ character string before upgrading
• Restrict network access to FileRise instances using firewall rules until patching is complete
• Disable public sharing features temporarily if immediate patching is not possible
• Place FileRise behind a VPN or reverse proxy with authentication to limit exposure

# Configuration example
# Generate a secure random key and set the environment variable
export PERSISTENT_TOKENS_KEY=$(openssl rand -base64 32)

# Or add to your docker-compose.yml or .env file:
# PERSISTENT_TOKENS_KEY=your-unique-cryptographically-strong-key-here