Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-5482 (GCVE-0-2026-5482)

Vulnerability from cvelistv5 – Published: 2026-06-15 11:44 – Updated: 2026-06-15 12:32 Unsupported When Assigned X_Open Source

Title

Remote Code Execution via Unrestricted File Upload in Responsive FileManager

Summary

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-15 12:32 UTC

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

CERT-PL CNA

References

2 references

URL	Tags
https://cert.pl/en/posts/2026/06/CVE-2026-5482	third-party-advisory
https://github.com/trippo/ResponsiveFilemanager	product

Impacted products

1 product

Vendor	Product	Version
Tecrail	Responsive FileManager	Affected: 0 , ≤ 9.14.0 (semver)

Date Public

2026-06-15 11:44

Credits

Kamil Szczurowski Robert Kruczek

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5482",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-15T12:32:30.749356Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-15T12:32:39.368Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Responsive FileManager",
          "programFiles": [
            "filemanager/dialog.php"
          ],
          "repo": "https://github.com/trippo/ResponsiveFilemanager",
          "vendor": "Tecrail",
          "versions": [
            {
              "lessThanOrEqual": "9.14.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Kamil Szczurowski"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Robert Kruczek"
        }
      ],
      "datePublic": "2026-06-15T11:44:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Responsive FileManager\u0027s allows an \u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eunauthenticated\u0026nbsp;\u003c/span\u003eattacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.\u0026nbsp;\u003cbr\u003e\u003cbr\u003eThis project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release\u0026nbsp;9.14.0\u0026nbsp;"
            }
          ],
          "value": "Responsive FileManager\u0027s allows an unauthenticated\u00a0attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.\u00a0\n\nThis project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release\u00a09.14.0"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-15T11:44:46.963Z",
        "orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
        "shortName": "CERT-PL"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://cert.pl/en/posts/2026/06/CVE-2026-5482"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/trippo/ResponsiveFilemanager"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "tags": [
        "unsupported-when-assigned",
        "x_open-source"
      ],
      "title": "Remote Code Execution via Unrestricted File Upload in Responsive FileManager",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6",
    "assignerShortName": "CERT-PL",
    "cveId": "CVE-2026-5482",
    "datePublished": "2026-06-15T11:44:46.963Z",
    "dateReserved": "2026-04-03T09:53:14.018Z",
    "dateUpdated": "2026-06-15T12:32:39.368Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2017-20145 (GCVE-0-2017-20145)

Vulnerability from cvelistv5 – Published: 2022-07-25 04:45 – Updated: 2025-04-15 14:02

Title

Tecrail Responsive Filemanger path traversal

Summary

A vulnerability was found in Tecrail Responsive Filemanger up to 9.10.x and classified as critical. The manipulation leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 9.11.0 is able to address this issue. It is recommended to upgrade the affected component.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L