CVE-2026-5482
published 2026-06-15CVE-2026-5482: Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to…
PriorityP265critical9.3CVSS 4.0
AVNACLATNPRNUINVCHVIHVAHSCLSILSALEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.45%
35.5th percentile
Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.
This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tecrail | responsive_filemanager | <= 9.14.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Tecrail Responsive FileManager up to 9.14.0 dialog.php unrestricted upload
vuldb·2026-06-15·CVSS 9.3
CVE-2026-5482 [CRITICAL] Tecrail Responsive FileManager up to 9.14.0 dialog.php unrestricted upload
A vulnerability, which was classified as critical, has been found in Tecrail Responsive FileManager up to 9.14.0. This affects an unknown part of the file dialog.php. The manipulation leads to unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer.
This vulnerability is traded as CVE-2026-5482. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.
ghsa_unreviewed·2026-06-15
CVE-2026-5482 [CRITICAL] CWE-434 Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.
Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.
This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-15
Published