Executive brief
Responsive FileManager, a popular open-source tool for managing files and images in web applications, contains critical security flaws that allow attackers to take full control of the hosting server. By exploiting these vulnerabilities, an unauthorized user can read sensitive system files or upload and execute malicious scripts. Because the project has been discontinued, no official security patches will be released, leaving all installations of version 9.14.0 permanently at risk.
Technical details
Responsive FileManager 9.14.0 contains two critical vulnerabilities: a Local File Inclusion (LFI) flaw in 'force_download.php' and an arbitrary file creation flaw in 'execute.php'. The LFI vulnerability occurs via the 'name' parameter, allowing attackers to use path traversal (e.g., ..\..\) to read sensitive files like /etc/hosts or configuration files. The arbitrary file creation vulnerability allows attackers to bypass file extension filters by appending '..' to the filename in the 'create_file' action, enabling the upload of PHP shells. These attacks can be performed remotely without authentication. The vendor has confirmed the project is discontinued and no patches will be issued.
Affected products
- Responsive FileManager Responsive FileManager 9.14.0
Timeline
- 2025-08-21: disclosed: Vulnerability reported to vendor by CSA
- 2025-08-21: other: Vendor confirmed project is discontinued and will not be patched
- 2026-05-28: advisory: Public advisory and CVE published