PT-2026-49203 · WordPress · Responsive Filemanager

Kamil Szczurowski + 1 · CVE-2026-5482 · Published 2026-06-15 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions Responsive FileManager version 9.14.0

Description An unauthenticated attacker can upload files of any type and extension without restriction via the 'dialog.php' endpoint. This unrestricted file upload can lead to Remote Code Execution, which allows an attacker to execute arbitrary code on the server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-5482

Affected Products

Responsive Filemanager

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5482.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-5482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5482 · Security Note
• https://github.com/trippo/ResponsiveFilemanager · Note
• https://cert.pl/en/posts/2026/06/CVE-2026-5482 · Note
• https://twitter.com/CVEnew/status/2066583808573329476 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2066523643060887616 · Twitter Post
• https://twitter.com/f1tym1/status/2066504637771821328 · Twitter Post