Is CVE-2026-57493 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57493 being exploited in the wild.

How severe is CVE-2026-57493?

Medium severity, with a CVSS score of 6.8, published 14 October 2026.

Is there a fix for CVE-2026-57493?

Yes: fixed in 3.16.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57493 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-57493?

Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57493: FileRise privilege escalation in remember-me token handling

CVE-2026-57493 · Severity: medium · CVSS 6.8 · Published 2026-10-14

FileRise is a web-based file manager that allows administrators to manage files remotely. Prior to version 3.16.0, the application stores administrator privileges in remember-me login tokens and fails to update these privileges when a user is demoted, allowing a demoted administrator to retain admin access by using an old token. An attacker with access to a pre-demotion token can use it to regain administrative control over the file manager.

Technologies: Filerise. Vendors: Filerise.

Quick answers

Is CVE-2026-57493 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57493 being exploited in the wild.
How severe is CVE-2026-57493?: Medium severity, with a CVSS score of 6.8, published 14 October 2026.
Which products and versions are affected?: Filerise before 3.16.0.
Is there a fix for CVE-2026-57493?: Yes: fixed in 3.16.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57493 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-57493?: Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.16.0

Technical details

FileRise stores the isAdmin flag within remember-me tokens and restores this stale value during automatic login rather than checking the current user role from users.txt. A user demoted from administrator status can retain administrative access using a token issued before demotion, and token rotation propagates the stale privilege into replacement tokens. Exploitation requires possession of a remember-me token from before the user's demotion; the fix in 3.16.0 resolves admin status from the current user record instead of trusting cached role data.

Affected products

FileRise FileRise before 3.16.0

Timeline

2026-10-14: advisory
2026-06-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.