FileRise: Authentication bypass via spoofed reverse-proxy identity header
Summary
FileRise versions before 3.16.0 with AUTH_BYPASS (proxy-header login) enabled trust the configured reverse-proxy identity header without verifying that the request came from a trusted proxy listed in FR_TRUSTED_PROXIES. If the backend application port is reachable directly, an unauthenticated attacker can send a forged X-Remote-User header and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw only applies to deployments that enable proxy-header authentication and expose an untrusted path to the backend.
Affected
- error311 FileRise, all versions before 3.16.0
- Only deployments with AUTH_BYPASS (proxy-header login) enabled and a directly reachable backend port
Fixed in
- Fixed in FileRise 3.16.0
- Later releases exist; the latest release is recommended
Workaround
- If proxy-header login is used, set FR_TRUSTED_PROXIES to the reverse proxy IP or CIDR before upgrading; otherwise the identity header is ignored and users are not auto-authenticated
- Block direct access to the FileRise backend port from everything except the reverse proxy
Exploitation
- CISA SSVC: exploitation status 'poc', automatable: no, technical impact: total
- Not in CISA KEV; no public proof-of-concept found in the sources reviewed
- No known exploitation in the wild
Our recommendation
- Identify all FileRise instances and their versions
- Upgrade instances below 3.16.0 to the latest release; set FR_TRUSTED_PROXIES first if proxy-header login is used
- Ensure the backend port is not reachable from untrusted networks, and only the reverse proxy can reach it
- Review admin accounts and active sessions on exposed instances for unexpected activity
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-98pg-w3jp-r8fv github.com
- Fix commit f7114ca github.com
- FileRise Release v3.16.0 github.com
- OSV record CVE-2026-57489 osv.dev
- OpenCVE CVE-2026-57489 app.opencve.io
- FileRise changelog filerise.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:01.
Original description (NVD)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. When the backend application port is reachable directly, an unauthenticated attacker can supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend. This issue is fixed in version 3.16.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.