EUVD-2026-52798
GHSA-fpqv-x64q-rhgj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no auth or interaction; scope changes because uploaded PHP executes server-side, enabling full C/I/A compromise.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
AnalysisAI
Unrestricted file upload in Trippo ResponsiveFilemanager (all versions through 9.14.0) exposes the dialog.php endpoint to unauthenticated remote attackers, enabling arbitrary file upload to the server. The product is end-of-life with no vendor support and no patch forthcoming; the vendor did not respond to disclosure. A public proof-of-concept exploit is available on GitHub, making exploitation accessible to a wide range of threat actors. The CVSS 4.0 vector rates the score at 6.9 (E:P), but the underlying CWE-434 class in a PHP application typically enables web shell deployment and full server compromise beyond what the assigned impact metrics suggest.
Technical ContextAI
ResponsiveFilemanager is a PHP-based web file manager library (CPE: cpe:2.3:a:trippo:responsivefilemanager:*:*:*:*:*:*:*:*) commonly embedded into CMS or custom PHP applications to provide browser-based file management. The vulnerable function resides in filemanager/dialog.php, which handles file upload operations. CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: the application fails to validate uploaded file types, allowing an attacker to upload executable PHP scripts or other dangerous files. In a PHP hosting environment, a successfully uploaded PHP file is directly executable via HTTP request, converting a file upload vulnerability into remote code execution. The affected version range spans the entire version 9.x line from 9.0 through 9.14.0, as enumerated by EUVD-2026-52798.
RemediationAI
No vendor-released patch has been identified at time of analysis - the maintainer declared the product end-of-life and did not respond to the disclosure. The primary remediation is to remove ResponsiveFilemanager entirely and migrate to an actively maintained file management solution. If immediate removal is not feasible, restrict access to filemanager/dialog.php via web server configuration (e.g., deny requests to that path in nginx/Apache) to block unauthenticated upload requests - note this may break legitimate file management functionality. Additionally, place the file manager behind authentication middleware at the web server or application layer to enforce PR:L or PR:H access control, which removes the unauthenticated attack vector. Network-level controls restricting access to the file manager to trusted IPs or internal networks provide a further compensating control. The public PoC is available at https://github.com/fa1c4/security-advisories/tree/main/responsivefilemanager/PoC and the VulDB entry is at https://vuldb.com/cve/CVE-2026-18788. Side effects of path-blocking: all file manager UI functionality for end-users will be disabled.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today