CVE-2026-104105CWE-287CWE-294

CVE-2026-104105

Medium · published October 15, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise verifies that a TOTP code is valid for the accepted time window but does not record that the same account and time step already succeeded. An attacker who has the target account's valid primary credential and captures a TOTP code after its successful use can replay that code from another pending-login session before the window closes. The issue does not by itself disclose the primary credential or TOTP code. This issue is fixed in version 3.23.0.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.6th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-294 · Authentication Bypass by Capture-replay
Published
2026-10-15T01:17Z
References (4)
https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a · [email protected]https://github.com/error311/FileRise/releases/tag/v3.23.0 · [email protected]https://github.com/error311/FileRise/security/advisories/GHSA-9pg4-98cx-r82j · [email protected]https://github.com/error311/FileRise/security/advisories/GHSA-9pg4-98cx-r82j · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 14 OCT 20:37Z
    FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
    cvelistv5
  • 14 OCT 20:37Z
    FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay)
    cvelistv5