Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations — HMAC token generation, AES config encryption, and session tokens — allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-20 | 2 | Disclosure1General1 |
| 2026-03-22 | 1 | Disclosure1 |
CVE-2026-33072 FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used fo… https://www.cve.org/CVERecord?id=CVE-2026-33072
Post summary
The post discloses that FileRise versions before 3.9.0 use a hardcoded default encryption key, highlighting a security weakness but providing no exploit, patch, or active exploitation details.
🟠 CVE-2026-33072 - High FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic opera... https://www.thehackerwire.com/vulnerability/CVE-2026-33072/ https://t.co/svgk7AqxNB
Post summary
The CVE‑2026‑33072 disclosure highlights that FileRise versions before 3.9.0 use a hardcoded default encryption key, indicating a high‑severity risk to cryptographic integrity.
CVE-2026-33072 FileRise Web File Manager Cryptographic Vulnerability in Versions... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-33072 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A brief tweet linking to a vulnerability page for CVE‑2026‑33072, offering no additional context, exploits, patches, or claims of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | filerise | filerise | - | - | - |