Executive brief
Responsive FileManager is an open-source tool used to manage and upload files within web editors like TinyMCE and CKEditor. A critical security flaw allows anyone on the internet to upload malicious files to the server without needing a password. This could allow an attacker to take complete control of the web server, potentially leading to data theft or a total service shutdown.
Technical details
A vulnerability classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) exists in Responsive FileManager through version 9.14.0. The flaw is located in the 'dialog.php' endpoint, which fails to properly validate file types or extensions during the upload process. An unauthenticated remote attacker can exploit this by sending a specially crafted request to upload arbitrary files, such as PHP scripts, to the web server. Execution of these files results in full Remote Code Execution (RCE). As the project is currently unmaintained and archived, no official patch is expected.
Affected products
- Tecrail Responsive FileManager All versions through 9.14.0
Timeline
- 2024-11-15: other: GitHub repository archived by owner
- 2026-06-15: advisory: Advisory published by CERT Polska
- 2026-06-15: disclosed: CVE-2026-5482 published