What is the CVSS score of CVE-2026-37637?

CVE-2026-37637 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Alexantr filemanager are affected by CVE-2026-37637?

Alexantr filemanager v1.0 contains an unpatched remote code execution vulnerability (CVE-2026-37637, CVSS 9.1) that allows attackers to gain complete system control without authentication or user…

How to fix or mitigate CVE-2026-37637?

Within 24 hours: Immediately isolate all Alexantr filemanager v1.0 instances from internet-facing access; audit logs for exploitation attempts. Within 7 days: Migrate to an alternative file management solution or cease use of the product; conduct forensic analysis for signs of unauthorized access or code execution. Within 30 days: Complete inventory of all Alexantr filemanager deployments and confirm removal from production; document remediation steps and identify systemic gaps in third-party software vetting.

Alexantr filemanager CVE-2026-37637

CRITICAL

Code Injection (CWE-94)

2026-06-29 mitre

Code Injection PHP RCE N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.8 CRITICAL

Network-reachable unauthenticated code injection with no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary code execution yields total impact, so C/I/A all High (A raised from the input's A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 22:30 vuln.today

CVSS changed

Jun 29, 2026 - 21:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component

AnalysisAI

Remote code execution in Alexantr filemanager v1.0 lets remote attackers run arbitrary code through the filemanager.php component, mapped to CWE-94 (code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw requiring no authentication or user interaction, and publicly available exploit code exists (GitHub POC by SLO-CYBER-SEC). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify exposed filemanager.php endpoint

Delivery

Send crafted HTTP request with injected code

Exploit

Code injection executes in PHP context

Execution

Run arbitrary code as web server user

Impact

Read/modify files or pivot

Access

Identify exposed filemanager.php endpoint

Delivery

Send crafted HTTP request with injected code

Exploit

Code injection executes in PHP context

Execution

Run arbitrary code as web server user

Impact

Read/modify files or pivot

Vulnerability AssessmentAI

Exploitation	The exploitable surface is the filemanager.php component of Alexantr filemanager v1.0, which must be deployed and reachable over the network by the attacker. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals are largely consistent toward high real-world severity-per-instance: CVSS 9.1 with AV:N/AC:L/PR:N/UI:N (network, low complexity, no privileges, no interaction), SSVC technical impact 'total', and automatable 'yes'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker locates an internet-exposed filemanager.php endpoint and sends a crafted HTTP request injecting code into the vulnerable parameter, achieving server-side code execution as the web server user without any credentials or user interaction. Public proof-of-concept material exists in the referenced GitHub repository, and with CVSS AC:L and SSVC automatable=yes, exploitation could be scripted and mass-scanned, though no active exploitation is currently confirmed.
Remediation	No vendor-released patch identified at time of analysis and no fixed version is cited in the available data, so do not assume a fixed release exists. … Detailed patch versions, workarounds, and compensating controls in full report.