A critical vulnerability in FileRise allows unauthenticated attackers to gain unauthorized access to sensitive configuration data and perform arbitrary file uploads due to the use of hardcoded cryptographic keys.

This flaw involves the use of hardcoded cryptographic credentials (CWE-798) for HMAC token generation and AES encryption. An unauthenticated attacker can leverage these keys to forge session or upload tokens and decrypt administrative secrets, such as OIDC and SMTP credentials.

The reliance on a hardcoded key poses a severe risk to the confidentiality and integrity of the file management system. With a CVSS score of 8.2, this vulnerability enables an attacker to compromise sensitive administrative credentials and facilitate unauthorized file manipulation, potentially leading to full system takeover or lateral movement within the network.

Immediate Action: Update FileRise to version 3.9.0 or later immediately to remove the hardcoded key and implement secure configuration practices.

Proactive Monitoring: Review access logs for suspicious file upload activity and monitor for unauthorized attempts to access or modify administrative configuration settings.

Compensating Controls: Ensure the FileRise instance is isolated from the public internet using a VPN or restricted network access, and verify that the PERSISTENT_TOKENS_KEY environment variable is explicitly set to a strong, unique value.

Public Exploit Available: Unknown.

Given the ease of exploitation and the high impact on system security, administrators must treat this as a priority update. Immediate migration to version 3.9.0 is required to eliminate the risk posed by the hardcoded encryption keys. If an update is not immediately feasible, ensure the environment variables are manually overridden with high-entropy keys to mitigate the exposure.