CVE-2026-103977 error311 CVE debrief

Who should care

Defenders responsible for FileRise instances should assess exposure and prioritize upgrading to version 3.23.0 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or interact with FileRise deployments. They should verify instance versions, check for exposure, and plan remediation efforts to prevent potential unauthorized access.

Why it matters

CVE-2026-103977 allows an attacker with valid primary credentials to bypass TOTP rate limiting in FileRise versions before 3.23.0, potentially leading to unauthorized access. Defenders should prioritize verifying exposure and upgrading to version 3.23.0 or later.

• An attacker with valid primary credentials can attempt TOTP verification multiple times, potentially leading to unauthorized access
• Defenders must verify FileRise instance version and exposure to prioritize remediation
• Remediation requires upgrading to version 3.23.0 or later

Technical summary

FileRise self-hosted web-based file manager versions before 3.23.0 store failed TOTP verification attempts in session storage, allowing an attacker with valid primary credentials to bypass intended rate limiting and attempt TOTP verification multiple times. This vulnerability is critical as it could lead to unauthorized access if exploited. Defenders should prioritize verifying exposure of FileRise instances and upgrading to version 3.23.0 or later. The issue is fixed in version 3.23.0, which addresses the rate limiting bypass vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of FileRise instances and upgrading to version 3.23.0 or later.

Recommended defensive actions

• Verify FileRise instance version and check for exposure
• Upgrade to version 3.23.0 or later
• Monitor for suspicious login attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NVD records provide details on the vulnerability, including its description, CVSS score, and affected versions. The records confirm that FileRise self-hosted web-based file manager versions before 3.23.0 are vulnerable. Defenders should verify exposure and prioritize remediation efforts. Evidence is limited to public CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.