PT-2026-49203 · Tecrail · Responsive Filemanager

Kamil Szczurowski + 1 · Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-5482

NVD

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. 

This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-5482

Affected Products

Responsive Filemanager

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-5482 · Security Note
• https://github.com/trippo/ResponsiveFilemanager · Note
• https://cert.pl/en/posts/2026/06/CVE-2026-5482 · Note