What is the CVSS score of CVE-2026-44460?

CVE-2026-44460 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of FileRise are affected by CVE-2026-44460?

FileRise self-hosted file manager versions before 3.12.0 contain a two-factor authentication bypass that allows attackers with knowledge of user passwords to extract TOTP secrets and gain account…. A patch is available.

How to fix or mitigate CVE-2026-44460?

Within 24 hours: Identify all FileRise deployments and versions; flag systems handling sensitive data as priority. Within 7 days: Update all instances to FileRise 3.12.0 or later; after patching, require all users with TOTP enabled to re-enroll with new secrets. Within 30 days: Analyze authentication logs from the past 90 days for suspicious access patterns in pending_login_user sessions; cross-reference any detected compromised passwords to assess exposure window.

FileRise CVE-2026-44460

EUVD-2026-32584 HIGH

Information Exposure (CWE-200)

2026-05-27 security-advisories@github.com

PHP File Upload Information Disclosure

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:07 vuln.today

Patch available

May 27, 2026 - 19:46 EUVD

DescriptionGitHub Advisory

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured, the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0.

AnalysisAI

Two-factor authentication bypass via TOTP secret disclosure affects FileRise self-hosted file manager before 3.12.0, where the /api/totp_setup.php endpoint can be reached from the intermediate 'pending_login_user' session state that exists after a correct password but before the TOTP check. For accounts that already have TOTP enabled, the endpoint decrypts and returns the existing TOTP secret inside the enrollment QR PNG rather than refusing, so an attacker who already holds the victim's password can extract the seed, compute a valid one-time code, and complete login without the victim's authenticator. No public exploit has been identified at time of analysis and no EPSS score is provided, but the issue fully defeats the second authentication factor.

Technical ContextAI

FileRise is a PHP-based, self-hosted web file manager. The relevant component is its login state machine: after a user submits the correct password, the session enters a 'pending_login_user' state in which only the TOTP step remains. The /api/totp_setup.php endpoint is intended for initial authenticator enrollment and renders a provisioning QR code (PNG) that encodes the account's TOTP secret. The flaw is a CWE-200 (Exposure of Sensitive Information) issue: when an account already has TOTP configured, the endpoint should refuse or generate a fresh secret, but instead it decrypts the stored secret and re-serves the live seed in the QR image. Because that endpoint is callable while only the password gate has been passed, the secret material that backs the second factor is exposed to anyone holding the first factor.

RemediationAI

Upgrade to FileRise 3.12.0, which contains the vendor-released fix (Vendor-released patch: 3.12.0); see the advisory at https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8. Because the bug exposes the live TOTP seed, treat any pre-3.12.0 account whose password may be known to a third party as compromised: after upgrading, require affected users to reset (re-enroll) their TOTP authenticators so a previously leaked secret is invalidated, and force password rotation for accounts suspected to have leaked credentials. If immediate upgrade is not possible, restrict network reachability of the FileRise instance (for example, place it behind a VPN or IP allowlist so only trusted clients can reach /api/totp_setup.php) - the trade-off is reduced accessibility for legitimate remote users - and monitor authentication logs for calls to /api/totp_setup.php followed quickly by /api/totp_verify.php from the same session, which would indicate this pattern.