CVE-2026-57490 in FileRise
Summary
by MITRE • 10/14/2026
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate() and does not enforce the account's configured TOTP factor. An attacker who knows valid primary credentials for a TOTP-enabled account can authenticate to the enabled WebDAV service without supplying the second factor and exercise the account's WebDAV file permissions. The browser login path enforces TOTP, but the separate public/webdav.php authentication callback did not. This issue is fixed in version 3.16.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in FileRise versions prior to 3.16.0 represents a critical failure in multi-factor authentication enforcement within the WebDAV service component of the application. FileRise operates as a self-hosted web-based file manager that supports features such as multi-file upload, editing, and batch operations. While the primary browser-based login interface correctly implements Two-Factor Authentication (2FA) by requiring both username/password credentials and a Time-based One-Time Password (TOTP), this security control was not consistently applied across all authentication endpoints. Specifically, the WebDAV service, which is enabled via administrative configuration, utilizes a separate public/webdav.php authentication callback that relies on AuthModel::authenticate(). This function validates only the primary account username and password, completely bypassing the TOTP verification step even when the account has explicitly configured 2FA as mandatory.
This architectural inconsistency creates a significant security gap where an attacker possessing valid primary credentials for any user with TOTP enabled can authenticate to the WebDAV service without providing the second factor. The operational impact of this flaw is severe, particularly in environments where FileRise is used for sensitive data storage or collaboration. Once authenticated via the vulnerable WebDAV endpoint, the attacker gains full access to all files and directories permitted by that user account's permissions. This includes the ability to read confidential documents, upload malicious payloads, modify existing content, or delete critical data. Since WebDAV protocols are often used for remote file management and synchronization, this vulnerability allows an adversary to interact with the server using standard HTTP methods such as GET, PUT, DELETE, and PROPFIND, effectively treating the compromised account as a fully authenticated user despite the absence of the second authentication factor.
From a classification perspective, this issue aligns with CWE-287: Improper Authentication, specifically reflecting a failure to enforce multi-factor authentication requirements across all application components. It also relates to CWE-306: Missing Authentication for Critical Function, as the WebDAV endpoint performs sensitive file operations without adequate identity verification relative to the account's security policy. In terms of attack vectors and tactics, this vulnerability facilitates unauthorized access that can be leveraged in conjunction with credential stuffing or phishing attacks where primary passwords are compromised but 2FA is assumed to provide sufficient protection. The MITRE ATT&CK framework categorizes such behaviors under T1078: Valid Accounts, as the attacker utilizes legitimate credentials obtained through external means to gain persistent access to system resources.
The root cause of this vulnerability lies in the separation of authentication logic between the web interface and the WebDAV service without proper synchronization of security policies. The AuthModel::authenticate() function appears to be a shared component that does not check for 2FA status when invoked by the public/webdav.php script, whereas other parts of the application likely invoke additional checks or use different authentication flows that respect TOTP requirements. This inconsistency suggests a lack of centralized enforcement mechanisms for multi-factor authentication across disparate service endpoints within the same codebase.
To mitigate this vulnerability and prevent similar issues in future development, it is imperative to ensure that all authentication entry points enforce the security policies defined at the account level. Developers should implement a unified authentication middleware or decorator that checks for 2FA requirements before allowing access to any protected resource, regardless of whether the request originates from the web interface or an API endpoint like WebDAV. Additionally, implementing strict input validation and ensuring that session management is consistent across all services can help reduce attack surfaces. For organizations currently running versions prior to 3.16.0, immediate upgrading to version 3.16.0 or later is required to resolve this flaw. In the interim, administrators should consider disabling WebDAV access entirely if it is not strictly necessary, thereby removing the vulnerable endpoint from exposure until a patch can be applied. Regular security audits and code reviews focusing on authentication flows across all modules are recommended to detect such inconsistencies early in the development lifecycle.