CVE-2026-103977: falha de alta gravidade em error311 FileRise
FileRise: Session-scoped TOTP rate limiting permits repeated verification attempts
Publicada em
38Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 8.1
da publicação à arma0 dias
Publicada no NVD14 de out.
1ª PoC1 de out.
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores failed TOTP verification attempts in $_SESSION. An attacker who already possesses a target account's valid primary credential can restart the login workflow in a new session and restore the second-factor attempt allowance, permitting continued online TOTP guessing beyond the intended five-attempt limit. The pending-login TOTP handlers did not share a durable account-wide limit. This issue is fixed in version 3.23.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
error311 · FileRisePoCs públicas encontradas — 1
githubgithub.com/pervinzahidli/CVE-2026-103977★ 0⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — error311 FileRise
No mesmo produto, das mais perigosas para as menos.
CVE-2026-25231HIGHFileRise affected by an Unauthenticated File Read Due to Insufficient Access ControlEPSS 1.7%CVE-2026-33071MEDIUMFileRise: WebDAV upload path bypasses filename validation enforced by regular uploadsEPSS 0.7%CVE-2026-54414CRITICALFileRise shared-folder upload path traversal allows arbitrary file write and admin takeoverEPSS 0.7%CVE-2026-33329HIGHFileRise: Path Traversal in `resumableIdentifier` Leading to Arbitrary File Write, Recursive Directory Deletion, and Limited Existence OracleEPSS 0.6%CVE-2026-92616HIGHFileRise < 3.28.0 Privilege Escalation via WebDAV Session InheritanceEPSS 0.4%CVE-2026-33330HIGHFileRise ONLYOFFICE integration allows read-only users to overwrite files via forged save callbackEPSS 0.4%