CVE-2026-77427

Executive Summary

CVE-2026-77427 is a use of hard-coded cryptographic key vulnerability (CWE-798) affecting FileRise, a self-hosted web-based file manager, in versions from 3.9.0 until 3.22.0. Pristine manual installations that lack a PERSISTENT_TOKENS_KEY configuration or a metadata/persistent_tokens.key file will activate a published legacy compatibility key, which can be used to decrypt TOTP secrets or credentials if an attacker separately obtains ciphertext-bearing account or configuration files. This secondary decryption vector raises the effective severity for environments where encrypted state files are exposed, though exploitation requires the prerequisite of obtaining those files and is therefore assigned a reduced CVSS score of 5.9 (High confidentiality impact, High attack complexity).

Technical Analysis

The vulnerability resides in FileRise's handling of persistent token encryption keys. According to the NVD description, manual (non-Docker) installations performed without explicitly setting the PERSISTENT_TOKENS_KEY environment variable, and without an existing metadata/persistent_tokens.key file, will fall back to a "published legacy compatibility key." This represents a hard-coded cryptographic key embedded in the application source or distribution, which is the textbook definition of CWE-798.

The affected version range is explicitly stated as "from 3.9.0 until 3.22.0." The root cause is a flawed key provisioning/initialization routine: rather than refusing to operate or generating a unique key at first run, the software substitutes a well-known static key. Because this key is "published," any party with knowledge of the FileRise codebase can obtain it.

The encryption surface includes what the description calls "ciphertext-bearing account or configuration files." Specifically, the fallback key protects encrypted TOTP (time-based one-time password) secrets and stored credentials. The confidentiality impact is therefore High (C:H) — successful decryption yields multi-factor authentication seeds and credential material. Integrity and availability impacts are None (I:N/A:N), consistent with the CVSS vector.

Attack complexity is High (AC:H) because exploitation is not a single-step remote request. Two conditions must coincide: (1) a pristine manual installation that has not overridden or generated a unique key, and (2) separate acquisition of the ciphertext-bearing files by the attacker. The description explicitly notes that Docker installations already generated a unique persistent key and are therefore not affected by the fallback. It also notes that existing installations are not automatically rotated, because rotation could render already-encrypted state unreadable — leaving the fallback-active condition persistent for unpatched manual deployments.

The CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a network-reachable flaw requiring no privileges and no user interaction, but with high attack complexity and confidentiality-only impact. No public PoC, Nuclei template, or exploit code is available at the time of writing.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-798, hard-coded key) and the conditions stated in the NVD description.

1. Reconnaissance / target identification. The attacker identifies internet-exposed or internally reachable FileRise instances, focusing on manual installations running versions 3.9.0 through 3.21.x. Docker-based deployments are explicitly not vulnerable to the fallback-key path and can be deprioritized. Fingerprinting relies on exposing the FileRise web file manager interface via HTTP title or content.

2. Trigger of the flaw class. The attacker does not need to trigger the fallback remotely — it activates passively during installation/initialization. The attacker instead performs secondary reconnaissance or exploitation to obtain "ciphertext-bearing account or configuration files." These are filesystem-level artifacts (the description references metadata/persistent_tokens.key as the expected unique-key location, and refers to account/configuration files separately). Because this step requires separate acquisition, attack complexity is High. Typical acquisition paths at the vulnerability-class level include misconfigured directory exposure, backup leakage, or another unrelated compromise that grants read access to application state.

3. Payload / execution method (class-level). Once ciphertext is obtained, the attacker applies the known published legacy compatibility key to decrypt TOTP secrets or stored credentials. This is an offline cryptographic operation — the attacker reproduces the application's key-derivation/decryption routine using the static fallback key. No code execution or crafted request against the target is required at this stage.

4. Post-exploitation impact. Decrypted TOTP secrets allow the attacker to generate valid one-time codes, defeating the second factor on any account protected by those seeds. Decrypted credentials provide direct authentication material. The combined effect is potential full account takeover and lateral movement using legitimate credentials — a confidentiality-only but high-value outcome.

Impact Assessment

The blast radius is limited to manual FileRise installations (3.9.0–3.21.x) that lack both a PERSISTENT_TOKENS_KEY setting and a generated metadata/persistent_tokens.key. For those deployments, the impact is High confidentiality (CVSS C:H): TOTP seeds and credentials become recoverable by anyone possessing both the static key and the encrypted files.

Business impact centers on authentication integrity. Stolen TOTP secrets undermine MFA, which is often the last control protecting administrative or privileged file-management accounts. Compromised credentials on a self-hosted file manager can expose the entirety of stored files and batch operations. Because integrity and availability subscores are None, the immediate impact is data disclosure and downstream credential abuse rather than data destruction.

The reduced overall score of 5.9 and the High attack-complexity rating temper the risk: exploitation demands file-system access to encrypted state, which should normally be protected. Risk is highest where FileRise data directories, backups, or container-external volumes are inadvertently exposed. CISA KEV status is NO, and no active exploitation is reported.

There is a secondary, persistent operational risk: the description states existing installations are not automatically rotated even after upgrading, because rotation could break encrypted state. This means remediation may not fully neutralize exposure for already-encrypted data without an explicit rotation procedure.

Detection Guidance

Sigma Rule

title: FileRise Hard-Coded Legacy Key Usage or Persistent Token Key Access
id: 3f4a1c9e-7742-4d1b-9a6e-cve202677427
status: experimental
description: Detects access to FileRise persistent token key material or fallback-key decryption activity on manual installations (CVE-2026-77427).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77427
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_access
  product: linux
detection:
  selection_path:
    TargetFilename|endswith:
      - '/metadata/persistent_tokens.key'
      - 'persistent_tokens.key'
  selection_proc:
    Image|endswith:
      - '/fileRise'
      - '/python3'
    CommandLine|contains:
      - 'PERSISTENT_TOKENS_KEY'
  condition: selection_path or selection_proc
falsepositives:
  - Legitimate administrative key rotation or backup operations
level: medium
tags:
  - attack.credential_access
  - attack.t1552

YARA Rule

rule CVE_2026_77427_FileRise_Hardcoded_Key
{
    meta:
        author = "valtersit.com"
        description = "Detects references to FileRise legacy persistent tokens key fallback (CVE-2026-77427)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77427"
        date = "2026-01-01"
    strings:
        $s1 = "PERSISTENT_TOKENS_KEY" ascii wide
        $s2 = "persistent_tokens.key" ascii wide
        $s3 = "legacy compatibility key" ascii nocase wide
        $s4 = "persistent_tokens" ascii wide
    condition:
        (uint16(0) == 0x213C or uint32(0) == 0x464C457F) and
        any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77427 FileRise Hard-Coded Token Key - Persistent Token Config Access"; flow:to_server,established; http.uri; content:"persistent_tokens"; nocase; http.uri; content:"metadata"; nocase; classtype:attempted-recon; reference:cve,2026-77427; sid:202677427; rev:1;)

Elastic Detection

file where file.path : ("*metadata/persistent_tokens.key", "*persistent_tokens.key") and process.name : ("fileRise", "python3", "python")

Splunk SPL Query

index=filesystem OR index=endpoint
| search (file_path="*metadata/persistent_tokens.key" OR file_path="*persistent_tokens.key" OR process_command_line="*PERSISTENT_TOKENS_KEY*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, file_path, process_name
| where count > 0

Wazuh OSSEC Rule

<group name="filerise,cve-2026-77427,">
  <rule id="1007427" level="10">
    <decoded_as>syscheck</decoded_as>
    <field name="file">persistent_tokens.key</field>
    <description>CVE-2026-77427: FileRise persistent token key file accessed or modified - possible hard-coded legacy key abuse</description>
    <mitre>
      <id>T1552</id>
    </mitre>
  </rule>
  <rule id="1007428" level="12">
    <if_sid>1007427</if_sid>
    <match>modified</match>
    <description>CVE-2026-77427: FileRise persistent token key modification/rotation event detected</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Explicitly set a strong, unique PERSISTENT_TOKENS_KEY environment variable on all manual FileRise installations to override the published legacy compatibility key.
   • Restrict filesystem and network access to the FileRise metadata/ directory and any account/configuration files containing ciphertext, since exploitation requires separately obtaining these.
   • Audit for accidental exposure of backups, volumes, or data directories containing encrypted state.

2. Patch/upgrade steps:

   • Upgrade to FileRise version 3.22.0, which the NVD description states fixes the issue.
   • Note the vendor warning: existing installations are not automatically rotated. Because rotation could make encrypted state unreadable, plan an explicit key-rotation procedure and re-encryption where feasible, and treat previously encrypted TOTP seeds and credentials as potentially compromised.

3. Long-term hardening:

   • Never ship or enable static fallback cryptographic keys; require unique per-installation key generation at first run.
   • Treat MFA seeds and stored credentials as high-sensitivity data; monitor for exfiltration and rotate any secrets that may have been protected by the fallback key.
   • Enforce least-privilege file-system permissions and monitor access to key material with the detection rules above.

References

• NVD — CVE-2026-77427: https://nvd.nist.gov/vuln/detail/CVE-2026-77427
• CWE-798: Use of Hard-coded Credentials: https://cwe.mitre.org/data/definitions/798.html
• FileRise project repository (vendor): https://github.com/filerise/fileRise (returned 404 — verify manually)
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• FIRST EPSS: not yet scored (no value available at time of writing)

No threat actor campaigns or exploit-in-the-wild evidence are currently associated with CVE-2026-77427. CISA KEV status: NO.