FileRise, a self-hosted web-based file manager, lacks a durable marker to indicate that installation has been completed. When the users.txt file is empty or missing after the system has been set up, the application re‑enters setup mode. An unauthenticated remote caller can then access the setup wizard and create a new administrator account, giving full control over the file manager and compromising the host. This flaw effectively allows an attacker to gain privileged access without any credentials, which is a direct path to complete system compromise.

The vulnerability is present in all FileRise releases from error311 before version 3.16.0. The issue was addressed in the 3.16.0 release, which adds a reliable, persistent marker to prevent re‑activation of the setup flow when the user store is empty. All earlier versions are vulnerable; upgrading to 3.16.0 or a later compatible release is required to mitigate this risk.

The CVSS score of 7.4 denotes a medium‑to‑high severity, indicating that the flaw can be abused to acquire full system privileges. The EPSS score is not available, so the precise likelihood of exploitation is unknown, but the flaw permits remote unauthenticated access to the setup interface, which is widely reachable over the internet. The vulnerability is not listed in the CISA KEV catalog, so there is no public evidence of active exploitation, although the risk remains high if the system is publicly exposed. Attackers would need only to visit the web application’s setup URL when users.txt is empty, which could result from data loss, truncation, or recovery operations that inadvertently wipe the file.