CVE-2026-33072 - Vulnerability Analysis

Overview

FileRise < 3.9.0 contains a broken authentication caused by a hardcoded default encryption key used for all cryptographic operations, letting unauthenticated attackers forge upload tokens and decrypt admin secrets, exploit requires default key usage.

Severity & Score

Impact

Unauthenticated attackers can upload arbitrary files and decrypt sensitive admin secrets, leading to full system compromise.

Mitigation

Update to version 3.9.0 or later.

References

• https://github.com/error311/FileRise/releases/tag/v3.9.0
• https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner