Executive brief
Trippo ResponsiveFilemanager is a file management component commonly embedded in web applications. A critical authentication bypass allows unauthenticated remote attackers to upload and create arbitrary files (including PHP, HTML, and JavaScript) through the dialog.php endpoint. This enables arbitrary code execution, phishing attacks, defacement, and compromise of the affected website.
Technical details
The vulnerability is a missing authorization flaw in filemanager/dialog.php and filemanager/execute.php that allows unauthenticated file creation when USE_ACCESS_KEYS is set to false (the default). An attacker can initialize a file manager session without credentials via GET /filemanager/dialog.php, then exploit the same session to call execute.php?action=create_file and write arbitrary content (HTML, JS, PHP) to the publicly accessible /source/ directory. No authentication or authorization checks guard the create_file action. An unauthenticated remote attacker can exploit this over the network to upload webshells, inject scripts, or host malicious content. Version 9.14.0 and earlier are affected; the vendor has not responded to disclosure and the product is no longer maintained.
Affected products
- Trippo ResponsiveFilemanager up to 9.14.0
Timeline
- 2026-08-04: disclosed
- exploited: Public PoC released on GitHub