Key points
- CVE-2026-57490 affects FileRise versions prior to 3.16.0 when WebDAV is enabled.
- The bug allows login without TOTP, rated CVSS 8.1 HIGH by NVD.
- Version 3.16.0 patches the authentication bypass in the WebDAV callback.
FileRise versions older than 3.16.0 contain a high-severity authentication bypass that affects systems with WebDAV enabled. The flaw allows attackers to access accounts without providing the required second factor. Version 3.16.0 resolves this issue by enforcing TOTP checks in the WebDAV authentication path.
In plain English
FileRise is a self-hosted web file manager that supports multi-file uploads and batch operations. When administrators enable WebDAV, users can access files via that protocol. The browser login screen correctly requires both a password and a time-based one-time password. However, the separate WebDAV login endpoint ignored the second factor. An attacker who knows the username and password can log in via WebDAV without the TOTP code. This grants them the file permissions associated with that account.
The background
The National Vulnerability Database lists this flaw as CVE-2026-57490 with a CVSS score of 8.1, which is rated as HIGH. The weakness is classified under CWE-308, which covers authentication issues. The problem existed because the `public/webdav.php` authentication callback did not enforce the account's configured TOTP factor. The standard `AuthModel::authenticate()` function was used, but it only validated the primary username and password. This discrepancy created a gap where the second factor was skipped for WebDAV traffic.
What changes now
The vendor has released version 3.16.0 to fix this authentication bypass. This update ensures that the WebDAV service enforces TOTP just like the browser login path does. Systems running versions prior to 3.16.0 remain vulnerable if WebDAV is active. Administrators must upgrade to 3.16.0 or later to close this gap. No other mitigations or patches have been confirmed for older versions.
Who needs to act first
Teams should prioritize updating systems that expose WebDAV to untrusted networks or the internet. Check whether any FileRise instances allow anonymous or guest access to WebDAV endpoints. Roll out the update to the most exposed systems first to reduce immediate risk. Test the upgrade in a staging environment to ensure file operations remain stable. Back up configuration files and user data before applying changes. Monitor logs for failed login attempts during the transition period.
Background: Authentication bypass vulnerabilities
Enforce server-side session validation for every request. Use short-lived tokens with strict scope. Implement multi-factor authentication to block credential theft. Remove client-side logic that makes access decisions. Audit your code for logic flaws that skip verification steps.
Read the full guide: Stop Authentication Bypass Vulnerabilities with Priority Controls
What to do and how to stay safe: FileRise
- Identify all FileRise installations running versions older than 3.16.0 that have WebDAV enabled.
- Verify if any accounts using WebDAV rely solely on password authentication without TOTP enforcement.
- Plan an upgrade to version 3.16.0 to ensure TOTP is required for all authentication methods.
- Review access logs for unusual WebDAV activity that may indicate exploitation of this bypass.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which FileRise versions are affected by CVE-2026-57490?
All versions of FileRise prior to 3.16.0 are affected when WebDAV is enabled.
Is there a fix available for this vulnerability?
Yes, version 3.16.0 includes the patch that enforces TOTP on the WebDAV service.
What is the severity rating of this flaw?
The NVD rates CVE-2026-57490 as HIGH with a CVSS score of 8.1.
