High severity · published Oct 14, 2026
CVE-2026-57492
FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation
7.4
CVSS
0.3%
EPSS
No
On KEV
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FI
FileRise · error311
< 3.16.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57492
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57492
github.com
https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6
github.com
https://github.com/error311/FileRise/releases/tag/v3.16.0
github.com
https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8
More from FileRise
9.8
CVE-2026-54414
FileRise shared-folder upload path traversal allows arbitrary file write and admin takeover
8.8
CVE-2026-33071
FileRise: WebDAV upload path bypasses filename validation enforced by regular uploads
8.2
CVE-2026-61843
FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares
8.1
CVE-2026-104108
FileRise OIDC login can bind an attacker identity to an existing local account
8.1
CVE-2026-103977
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts