FileRise Flaws Enable Token Forgery, Secret Decryption, and Arbitrary File Write

Two high-severity vulnerabilities in the self-hosted web file manager and WebDAV server FileRise exposed organizations to serious compromise. CVE-2026-33072 affects versions before 3.9.0 and stems from a hardcoded default value for PERSISTENT_TOKENS_KEY, which was reused for HMAC token generation, AES configuration encryption, and session-related functions. An unauthenticated attacker could use the shared key to forge upload tokens for arbitrary file uploads to shared folders and decrypt sensitive administrator configuration data, including OIDC client secrets and SMTP passwords.

A second flaw, CVE-2026-33329, affects FileRise versions 1.0.1 through before 3.10.0 and allows path traversal through the resumableIdentifier parameter in the Resumable.js chunked upload handler. An authenticated user with upload permission could write files to arbitrary server directories, trigger recursive deletion of arbitrary directories during cleanup, and use the behavior as a limited file or directory existence oracle. FileRise addressed the issues in versions 3.9.0 and 3.10.0, respectively, underscoring the need for administrators to upgrade promptly and review exposed secrets and file integrity.