CVE-2026-57490 FileRise: WebDAV authentication bypasses TOTP/MFA entirely

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

CVE-2026-57490

Prior to version 3.16.0 , the self-hosted file manager FileRise is vulnerable to an authentication bypass when WebDAV is enabled. The root cause lies in the public/webdav.php authentication callback, which validates only the username and password via AuthModel::authenticate() while failing to enf...

CVE-2026-104107: Improper Limitation of a Pathname to a Restricted Directory

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/saveFile.php operation accepts dot and dot-dot segments in its attacker-controlled folder input before ACL inheritance evaluates the uncanonicalized string. Wi...

CVE-2026-57490: Use of Single-factor Authentication

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, when an administrator has enabled WebDAV, FileRise WebDAV Basic authentication validates only the account username and password through AuthModel::authenticate and does not...

CVE-2026-96847

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-96846

Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally...

CVE-2026-96843

Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-88137

Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network...

CVE-2026-88136

Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network...

CVE-2026-88135

Improper access control in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-88126

Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-87714

Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network...

CVE-2026-85828

Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-85827

Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-85370

Use after free in WebDAV allows an authorized attacker to elevate privileges locally...

CVE-2026-70262

Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-102217

Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network...

CVE-2026-102217

A vulnerability exists in WebDAV due to improper resolution of path equivalence . This flaw allows an authorized attacker to achieve privilege elevation over a network. The vulnerability is associated with CWE-41 and has been assigned a HIGH base severity score of 8.8 under CVSS v3.1. No specific...

EUVD-2026-100372

Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network...

CVE-2026-96843

A heap-based buffer overflow vulnerability exists in WebDAV that allows an authorized attacker to achieve local privilege elevation . The vulnerability is assigned a High severity rating (CVSS 3.1 score of 7.8). No specific affected versions, root cause details, or remediation steps are provided ...