CVE-2026-44460

{
  "id": "CVE-2026-44460",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-27T18:16:23.707",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured, the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0."
    },
    {
      "lang": "es",
      "value": "FileRise es un gestor de archivos autoalojado basado en web con carga de múltiples archivos, edición y operaciones por lotes. Antes de la versión 3.12.0, /api/totp_setup.php es invocable desde una sesión que solo ha pasado la verificación de contraseña (estado pending_login_user). Cuando la cuenta objetivo ya tiene TOTP configurado, el endpoint descifra y devuelve el secreto TOTP existente del usuario dentro del PNG del QR en lugar de rechazar o generar un nuevo secreto. Un atacante que ya posee la contraseña de la víctima puede, por lo tanto, recuperar el secreto TOTP activo, derivar un código de un solo uso válido, enviarlo a /api/totp_verify.php y obtener una sesión completamente autenticada sin poseer nunca el dispositivo autenticador de la víctima. Esta vulnerabilidad está corregida en la versión 3.12.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "error311",
          "product": "FileRise",
          "versions": [
            {
              "version": "< 3.12.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-28T14:13:39.459794Z",
          "id": "CVE-2026-44460",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}