error311 FileRise: Rate limit bypass for TOTP verification allows repeated guessing

Summary

FileRise, a self-hosted web file manager, stores failed TOTP attempts in the PHP session, so starting a new login session restores the second-factor attempt allowance. An attacker who already knows a target account's valid primary password can keep guessing TOTP codes beyond the intended five-attempt limit. Exploitation requires the valid password and access to the login page.

Affected

• FileRise versions before 3.23.0

Fixed in

• Fixed in FileRise 3.23.0, which adds persistent account-wide and source-wide TOTP attempt budgets.

Workaround

• No vendor-documented workaround for unpatched versions.
• Interim measure (not from the vendor): restrict access to the login page to trusted networks or a VPN.

Exploitation

• No evidence of active exploitation found; not listed in the CISA KEV catalog (not checked directly).
• A public GitHub repository by the reporter exists; it is described as a write-up without executable code. Not verified.

Our recommendation

• Update FileRise to 3.23.0 or later.
• Until patched, restrict login page access to trusted networks or a VPN.
• Enforce strong, unique passwords and check for leaked ones.
• Review login logs for repeated TOTP failures.
• If OIDC is used, read the upgrade notes first, as OIDC accounts created before 3.23.0 are not automatically matched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  pervinzahidli/CVE-2026-103977

Research sources

• GitHub Security Advisory GHSA-4hfj-6478-5cv7 github.com
• FileRise v3.23.0 release github.com
• Fix commit cc11189 github.com
• OSV CVE-2026-103977 osv.dev
• FileRise changelog filerise.net

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:03.