CVE-2026-5482
Remote Code Execution via Unrestricted File Upload in Responsive FileManager
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jun 15, 2026
- Updated
- Jun 15, 2026
- Reserved
- Apr 3, 2026
Description
Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.
This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L | CERT-PL |
Weaknesses
- CWE-434 Unrestricted Upload of File with Dangerous Type
Affected Products
| Product | Versions |
|---|---|
Responsive FileManagerTecrail |
|
References
- https://cert.pl/en/posts/2026/06/CVE-2026-5482third-party-advisory
- https://github.com/trippo/ResponsiveFilemanagerproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.