CVE-2026-44460: FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret

Synopsis

This is an authentication bypass vulnerability in FileRise, a self-hosted web-based file manager. An attacker who already knows the victim's password can call the TOTP setup endpoint (/api/totp_setup.php) from a partially authenticated session and receive the victim's existing, live TOTP secret embedded in a QR code image, without needing the victim's authenticator device. Using that secret, the attacker derives a valid one-time code, submits it to the verification endpoint, and gains a fully authenticated session, completely bypassing multi-factor authentication. The vulnerability requires network access and no privileges beyond the victim's password, and is reachable over the internet. No patched version of FileRise has been published yet; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoints are exposed over the network, so the attacker must be able to reach the FileRise instance via HTTP/HTTPS from a remote location.

• AuthenticationNot required

  No account privileges are required beyond knowing the victim's password, which is a precondition described by the vulnerability itself rather than a privilege grant by the system.

• Victim interactionNot required

  The attacker interacts directly with the server-side API endpoints and does not need the victim to click a link or take any action.

• Attack complexityDetail

  Attack complexity is high, meaning exploitation depends on environmental factors such as the attacker already possessing the victim's password before attempting the TOTP secret retrieval.

Blast Radius

• The attacker reads the victim's live TOTP secret from the decrypted QR code payload, gaining permanent knowledge of that secret until it is rotated.
• The attacker derives valid one-time codes from the recovered secret and submits them to the verification endpoint to obtain a fully authenticated session.
• With a fully authenticated session, the attacker gains access to all files, uploads, edits, and batch operations available to the victim's account on the FileRise instance.
• Confidentiality and integrity of stored files are both compromised; the attacker can read, overwrite, or delete files within the scope of the victim account's permissions.