What is the CVSS score of CVE-2026-37266?

CVE-2026-37266 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Responsive FileManager are affected by CVE-2026-37266?

Responsive FileManager 9.14.0 contains a remote code execution vulnerability in the force_download.php component that enables authenticated users to execute arbitrary code with full system access…

How to fix or mitigate CVE-2026-37266?

Within 24 hours: inventory all Responsive FileManager 9.14.0 deployments; restrict user access to force_download.php to essential personnel only; disable the component if operationally feasible. Within 7 days: deploy Web Application Firewall rules to block exploitation attempts against force_download.php; isolate systems hosting FileManager to dedicated network segments; enable comprehensive audit logging of all FileManager access. Within 30 days: contact vendor for patch availability; deploy patch immediately upon release; if patch timeline is unclear, execute migration plan to alternative file management solutions.

Responsive FileManager CVE-2026-37266

HIGH

PHP Remote File Inclusion (CWE-98)

2026-05-28 cve@mitre.org

LFI RCE PHP

8.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.0 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 17:22 vuln.today

CVSS changed

May 28, 2026 - 17:22 NVD

8.0 (HIGH)

CVE Published

May 28, 2026 - 14:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_download.php component

AnalysisAI

Remote code execution in Responsive FileManager 9.14.0 enables authenticated attackers to run arbitrary code on the underlying server by abusing the force_download.php component. The CWE-98 classification points to improper control of PHP file inclusion, and while no public exploit is identified at time of analysis, the high CVSS of 8.0 reflects full confidentiality, integrity, and availability impact once a target user interacts with the attacker-supplied input.

Technical ContextAI

Responsive FileManager is a free open-source PHP/JavaScript file manager widely embedded into CMSs and rich-text editors (TinyMCE, CKEditor) to provide upload and media-browsing functionality. The vulnerable component, force_download.php, is a download helper that streams a server-side file to the client; CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program - 'PHP Remote File Inclusion') indicates the script handles a path/filename parameter without sufficiently constraining it, allowing the PHP interpreter to be coerced into including or executing attacker-controlled content. Because the vulnerable endpoint is a PHP script reachable over HTTP within the application's web root, exploitation translates a file-path manipulation primitive into arbitrary PHP code execution under the web server's user context.

Affected ProductsAI

Responsive FileManager version 9.14.0 (vendor: Responsive File Manager, project site https://www.responsivefilemanager.com/) is the only version explicitly named in the advisory; the third-party write-up at https://csacyber.com/blog/responsive-filemanager-version-9-14-0-multiple-vulnerabilities-cve-2026-37266 references this release alongside other vulnerabilities in the same build. No CPE strings were provided in the input, and the advisory does not enumerate earlier branches, so administrators running 9.13.x or any embedded fork (TinyMCE/CKEditor integrations, CMS plugins bundling RFM) should treat their version as potentially impacted until confirmed otherwise.

RemediationAI

No vendor-released patch identified at time of analysis; consult the project site at https://www.responsivefilemanager.com/ and the disclosure write-up at https://csacyber.com/blog/responsive-filemanager-version-9-14-0-multiple-vulnerabilities-cve-2026-37266 for an updated release post-9.14.0. As compensating controls, block external access to /filemanager/force_download.php at the web server or WAF layer (trade-off: legitimate downloads through that helper will break - applications relying on it must switch to a static download path), restrict the entire filemanager directory to authenticated admin IPs via .htaccess or reverse-proxy ACLs (trade-off: editor users on dynamic IPs lose access), set PHP allow_url_include=Off and allow_url_fopen=Off in php.ini to defeat the RFI variant of CWE-98 (trade-off: any code legitimately depending on remote URL streams will fail), and chroot/jail the PHP process so that even successful inclusion cannot reach sensitive system paths. Rotate any credentials handled by accounts with filemanager access in case exploitation has already occurred.