Is CVE-2026-77427 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77427 being exploited in the wild.

How severe is CVE-2026-77427?

Medium severity, with a CVSS score of 5.9, published 14 October 2026.

How is CVE-2026-77427 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-77427?

Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77427: FileRise weak default encryption key in pristine installations

CVE-2026-77427 · Severity: medium · CVSS 5.9 · Published 2026-10-14

FileRise is a self-hosted web-based file manager used to store and manage files. Pristine manual installations up to version 3.22.0 could fall back to using a publicly known encryption key instead of generating a unique one, allowing an attacker who obtains encrypted account or configuration files to decrypt TOTP secrets and user credentials. Docker installations and existing manual installs with state are not affected.

Technologies: Filerise. Vendors: Filerise.

Quick answers

Is CVE-2026-77427 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77427 being exploited in the wild.
How severe is CVE-2026-77427?: Medium severity, with a CVSS score of 5.9, published 14 October 2026.
Which products and versions are affected?: Filerise 3.9.0 to 3.21.0.
Is there a fix for CVE-2026-77427?: Yes: fixed in 3.22.0. Until then: Set a strong PERSISTENT_TOKENS_KEY environment variable or ensure metadata/persistent_tokens.key exists before first use. For existing legacy installations, use the Admin Panel to perform a controlled key rotation to replace the fallback key. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77427 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-77427?: Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.22.0

Set a strong PERSISTENT_TOKENS_KEY environment variable or ensure metadata/persistent_tokens.key exists before first use. For existing legacy installations, use the Admin Panel to perform a controlled key rotation to replace the fallback key.

Technical details

This vulnerability affects the PERSISTENT_TOKENS_KEY used to encrypt stored credentials and two-factor authentication secrets. Pristine manual FileRise installations (3.9.0 to before 3.22.0) without an explicit PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key file would use a published legacy fallback key. An attacker who gains access to encrypted state files (via backup exposure, file system access, or database compromise) can decrypt them using this known key. The attack requires offline access to ciphertext; Docker installations generated unique keys and existing installations are not automatically rotated.

Affected products

FileRise FileRise 3.9.0 to 3.21.0

Timeline

2026-10-14: disclosed
2026-07-13: patched: Version 3.22.0 released with fix; note the release date precedes the disclosure date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.