FileRise self‑hosted file manager disclosed that manual installations lacking a persistent token key can fall back to a legacy compatibility key. An attacker who obtains encrypted configuration or account files can use this known fallback key to decrypt stored TOTP secrets or credentials, exposing sensitive authentication data.

The vulnerability affects FileRise installations from version 3.9.0 up to and including 3.22.0 when a PERSISTENT_TOKENS_KEY has not been set. Docker images generate a unique key at deployment and are not impacted. Existing installations that did not rotate keys remain vulnerable until the key is regenerated.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not reported. The vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation. The attack requires access to ciphertext‑bearing files and the absence of a unique persistent key. An attacker can achieve confidential data leakage by leveraging the default fallback key, making the risk significant for systems where deployment practices do not enforce key rotation.