{"metadata": {"vulnerability": "CVE-2026-77427", "count": 10, "kinds": {"milestone": 3, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-08-20T19:59:59.603Z", "date_only": false, "value": "2026-08-20T19:59:59.603Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77427", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T20:32:55.815Z", "date_only": false, "value": "2026-10-14T20:32:55.815Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77427", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T20:32:55.815Z", "date_only": false, "value": "2026-10-14T20:32:55.815Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-77427", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T21:17:39.447Z", "date_only": false, "value": "2026-10-14T21:17:39.447", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77427", "record": "FKIE_CVE-2026-77427", "field": "published"}, {"timestamp": "2026-10-15T00:47:18.506Z", "date_only": false, "value": "2026-10-15T00:47:18.506468Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117442165455278973", "record": "CVE-2026-77427", "field": "creation_timestamp", "uuid": "f4d87850-262c-4414-b0e8-a82c40c378b4", "content": "CVE-2026-77427 FileRise: Insecure default cryptographic key fallback in manual installs FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine manual FileRise installations without PERSISTENT_TOKENS_KEY or metadata/persistent_tokens.key can activate a published legacy compatibility key. If an attacker separately obtains ciphertext-bearing account or configuration files, the known fallback key can enable decryption of TOTP secrets or credentials. Docker installations already generated a unique persistent key, and existing installations are not automatically rotated because doing so could make encrypted state unreadable. This issue is fixed in version 3.22.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77427https://github.com/error311/FileRise/security/advisories/GHSA-g6p5-9cpq-mp5hhttps://github.com/error311/FileRise/commit/b5213b66d4c668a45f1b7600aa62b79cb66ddbe6https://github.com/error311/FileRise/releases/tag/v3.22.0#error311 #FileRise#CVE_2026_77427#bot", "url": "https://infosec.exchange/users/cve/statuses/117442165455278973"}, {"timestamp": "2026-10-20T02:08:44.589Z", "date_only": false, "value": "2026-10-20T02:08:44.589886Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77427", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T02:08:44.589Z", "date_only": false, "value": "2026-10-20T02:08:44.589886Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77427", "record": "FKIE_CVE-2026-77427", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T02:09:06.968Z", "date_only": false, "value": "2026-10-20T02:09:06.968Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77427", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T02:09:06.968Z", "date_only": false, "value": "2026-10-20T02:09:06.968Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77427", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T03:17:16.560Z", "date_only": false, "value": "2026-10-20T03:17:16.560", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77427", "record": "FKIE_CVE-2026-77427", "field": "lastModified"}]}