{"id":"CVE-2026-57492","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-57492","generatedAt":"2026-10-28T07:41:00.270Z","title":"Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed.","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.","published":"2026-10-14T21:17:38.000Z","lastModified":"2026-10-15T16:18:18.000Z","status":"Deferred","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"3.1","score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-306"],"affected":[],"epss":{"score":0.00349,"percentile":0.28301,"date":"2026-10-27","history":[{"date":"2026-10-15","score":0.00274,"percentile":0.18505}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-14T21:17:38.000Z","detail":{"score":"7.4","severity":"HIGH","publishedAt":"2026-10-14T21:17:37.650Z"},"summary":"New CVE, high severity (CVSS 7.4)."}],"references":[{"url":"https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6","source":"security-advisories@github.com"},{"url":"https://github.com/error311/FileRise/releases/tag/v3.16.0","source":"security-advisories@github.com"},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8","source":"security-advisories@github.com"},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-57492","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}