Key points
- CVE-2026-57489 affects FileRise versions prior to 3.16.0 when proxy authentication is enabled.
- Attackers can gain unauthorized access, including admin rights, without passwords or multi-factor authentication.
- The vulnerability is resolved in version 3.16.0, which verifies request origins from trusted proxies.
FileRise deployments running versions earlier than 3.16.0 are affected by a high-severity authentication bypass flaw. A fix is available in version 3.16.0. This issue impacts self-hosted web-based file managers that use reverse-proxies for identity verification. Administrators must update to the patched version to prevent unauthenticated access to their systems. The vulnerability exists only when specific configuration settings are active.
In plain English
The flaw allows attackers to trick the system into trusting false identity information. FileRise versions before 3.16.0 trust reverse-proxy headers without checking if the request came from a trusted source. If the backend port is reachable directly, an attacker can send a fake header. This grants them a session for any account, including administrators. No password or multi-factor authentication is required to exploit this weakness.
The background
The issue is tracked as CVE-2026-57489 and rated High with a CVSS score of 8.1. It stems from CWE-290, a failure to properly verify authentication credentials. The problem occurs only when AUTH_BYPASS is enabled and the backend is exposed to untrusted paths. The vendor, error311, released version 3.16.0 to address this trust verification gap. The fix ensures requests are validated against the FR_TRUSTED_PROXIES list.
What changes now
Version 3.16.0 introduces stricter validation for proxy-header authentication. The update forces the application to verify that incoming requests originate from configured trusted proxies. This prevents external attackers from supplying spoofed X-Remote-User headers. Deployments that do not expose their backend ports directly are not vulnerable. Organizations using proxy authentication must upgrade to maintain security integrity.
Who needs to act first
Teams usually prioritize systems exposed to the internet or internal networks with high traffic. Check whether your FileRise instances allow direct access to backend ports. If proxy authentication is enabled, treat the update as urgent. Roll out the patch to a small group of servers first to verify stability. Back up configurations before making changes. Monitor logs for unusual login attempts while waiting for updates.
What to do and how to stay safe: FileRise
- Verify if your FileRise version is earlier than 3.16.0 and if AUTH_BYPASS is enabled.
- Update to version 3.16.0 as soon as possible to apply the security fix.
- Restrict direct access to the backend application port using firewall rules.
- Monitor server logs for unexpected login attempts or suspicious header activity.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is my FileRise instance vulnerable if I don't use proxy authentication?
No, the flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend.
What is the CVSS score for CVE-2026-57489?
The vulnerability has a CVSS score of 8.1, which is rated as High severity.
Does the fix require changing my proxy configuration?
The fix in version 3.16.0 verifies request origins against FR_TRUSTED_PROXIES; ensure your trusted proxy list is correctly configured.
