by Kastro
Paper/Archive/CVE-2026-5482

CVE-2026-5482

Tecrail Responsive FileManager — Remote Code Execution via Unrestricted File Upload in Responsive FileManager

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 38.7.387 × 207.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.  This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

Affected

ProductAffectedFixed inSource
Responsive FileManager≤ 9.14.0–CNA

Scores by source

CERT-PL (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

writeupcert.pl/en/posts/2026/06/CVE-2026-5482refgithub.com/trippo/ResponsiveFilemanager