FileRise versions before 3.9.0 use a default encryption key (default_please_change_this_key) hardcoded for all cryptographic operations, including HMAC token generation, AES config encryption, and session tokens. Because the key is predictable and not overridden, an attacker can forge upload tokens, allowing arbitrary file uploads to shared folders, and can decrypt administrator configuration, such as OIDC client secrets and SMTP passwords. The weakness represents CWE‑1188 (Use of Hardcoded Salt) and CWE‑798 (Use of Hardcoded Credentials). The impact includes loss of confidentiality and integrity for configuration data and potential unauthorized file placement.

The flaw affects the FileRise self‑hosted web file manager/WebDAV server in all releases earlier than version 3.9.0. Any deployment that has not set the PERSISTENT_TOKENS_KEY environment variable to a unique, strong value remains vulnerable. No other vendors or products are listed as impacted.

The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1 % suggests low current exploitation likelihood; FileRise is not in the CISA KEV catalog. Based on the description, the likely attack vector is HTTP based: an unauthenticated attacker crafts requests with forged tokens to upload files. Because the token generation uses the hardcoded key and no authentication is required, remote exploitation is possible without valid credentials, allowing upload of arbitrary files and extraction of sensitive configuration.