FileRise’s WebDAV feature, when enabled by an administrator, performs Basic authentication against the account’s username and password only, ignoring the configured TOTP factor. An attacker who knows valid primary credentials can therefore log in to the WebDAV endpoint without supplying the second factor, gaining the same file access rights as the legitimate user. This bypass allows the attacker to read, modify, delete, or upload files, threatening confidentiality, integrity, and availability of data stored in the application. The vulnerability is classified as a Weak Password Authentication Failure (CWE‑308).

FileRise by error311, versions earlier than 3.16.0, when the WebDAV service is enabled. The problem affects only the webdav.php authentication callback; the web browser login path still enforces TOTP. Users or administrators who have enabled two‑factor authentication for their accounts are particularly vulnerable if they rely on WebDAV for file operations.

The CVSS score of 8.1 indicates high severity, and the absence of an EPSS score means we lack precise exploitation probability data, but the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is remote: an adversary with valid credentials—or one who can obtain them via phishing or credential stuffing—can use any network within reach of the WebDAV port to authenticate without the second factor. Because the bypass is straightforward and does not require additional preconditions besides legitimate credentials, the risk of exploitation remains significant for deployments that rely on WebDAV for critical file handling.