CVE-2026-33072 - Vulnerability Analysis

Overview

FileRise < 3.9.0 contains a broken authentication caused by a hardcoded default encryption key used for all cryptographic operations, letting unauthenticated attackers forge upload tokens and decrypt admin secrets, exploit requires default key usage.

Severity & Score

Impact

Unauthenticated attackers can upload arbitrary files and decrypt sensitive admin secrets, leading to full system compromise.

Mitigation

Update to version 3.9.0 or later.

References

• https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x
• https://github.com/error311/FileRise/releases/tag/v3.9.0

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🟠 CVE-2026-33072 - High (8.2) FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33072/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner