Executive brief
FileRise is a self-hosted web-based file manager used for managing and sharing files. A security flaw in its login process allows an attacker who already knows a user's password to bypass two-factor authentication (2FA). By accessing a specific setup page during the login process, the attacker can retrieve the victim's secret 2FA key, allowing them to generate valid login codes and gain full access to the account and its files without needing the victim's physical device.
Technical details
A logic flaw exists in the `/api/totp_setup.php` endpoint where it incorrectly grants access to sessions in the `pending_login_user` state (users who have provided a valid password but not yet a TOTP code). When accessed, the endpoint decrypts and returns the user's existing TOTP secret within a QR code payload instead of generating a new one or denying the request. An attacker with knowledge of a user's password can programmatically fetch this QR code, extract the TOTP secret, and generate a valid one-time password to complete the authentication via `/api/totp_verify.php`. This effectively nullifies the security benefits of 2FA. The issue is fixed in version 3.12.0 by requiring a fully authenticated session for TOTP setup and preventing the re-emission of existing secrets.
Affected products
- error311 FileRise < 3.12.0
Timeline
- 2026-05-07: advisory: Vendor advisory published on GitHub
- 2026-05-27: disclosed: CVE published to NVD