Filerise EUVD-2026-13643

FileRise versions prior to 3.9.0 with default encryption key unchanged (default_please_change_this_key). Remote unauthenticated attacker can forge upload tokens and decrypt admin secrets without victim interaction.

The CVSS score of 8.2 (High) reflects network-based exploitation with low complexity requiring no authentication or user interaction, with high confidentiality impact and low integrity impact. The attack vector (AV:N) and lack of required privileges (PR:N) make this trivially exploitable by remote attackers. The vulnerability permits both arbitrary file upload (integrity impact) and decryption of sensitive administrative secrets like OIDC client secrets and SMTP passwords (confidentiality impact). While not currently listed in CISA KEV or showing elevated EPSS scores, the straightforward exploitation path and hardcoded nature of the vulnerability make it highly automatable for mass exploitation campaigns. Real-world risk is significant for any FileRise deployment that retained the default configuration, as attackers can enumerate FileRise instances and immediately exploit them without any reconnaissance or sophisticated techniques. This represents a genuine high-priority risk especially for internet-facing deployments.

An unauthenticated remote attacker identifies a FileRise installation and uses the publicly known hardcoded key 'default_please_change_this_key' to forge valid HMAC upload tokens, enabling arbitrary file upload to shared folders without authorization. The attacker then uses the same key to decrypt AES-encrypted configuration data, extracting OIDC client secrets to pivot into connected identity providers or SMTP passwords to send phishing emails appearing to originate from the organization. Given the network-accessible attack vector and low complexity (no authentication required), exploitation can be fully automated across internet-facing FileRise instances.