What is the CVSS score of CVE-2026-37637?

CVE-2026-37637 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Alexantr filemanager are affected by CVE-2026-37637?

Alexantr filemanager v1.0 contains an unpatched remote code execution vulnerability (CVE-2026-37637, CVSS 9.1) that allows attackers to gain complete system control without authentication or user…

How to fix or mitigate CVE-2026-37637?

Within 24 hours: Immediately isolate all Alexantr filemanager v1.0 instances from internet-facing access; audit logs for exploitation attempts. Within 7 days: Migrate to an alternative file management solution or cease use of the product; conduct forensic analysis for signs of unauthorized access or code execution. Within 30 days: Complete inventory of all Alexantr filemanager deployments and confirm removal from production; document remediation steps and identify systemic gaps in third-party software vetting.

Alexantr filemanager CVE-2026-37637

CRITICAL

Code Injection (CWE-94)

2026-06-29 mitre

PHP RCE Code Injection N A

9.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.8 CRITICAL

Network-reachable unauthenticated code injection with no interaction (AV:N/AC:L/PR:N/UI:N); arbitrary code execution yields total impact, so C/I/A all High (A raised from the input's A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 22:30 vuln.today

CVSS changed

Jun 29, 2026 - 21:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 29, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in Alexantr filemanager v.1.0 allows a remote attacker to execute arbitrary code via the filemanager.php component

AnalysisAI

Remote code execution in Alexantr filemanager v1.0 lets remote attackers run arbitrary code through the filemanager.php component, mapped to CWE-94 (code injection). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable flaw requiring no authentication or user interaction, and publicly available exploit code exists (GitHub POC by SLO-CYBER-SEC). SSVC rates exploitation as proof-of-concept with total technical impact and automatable=yes, but it is not on CISA KEV and no EPSS score was provided.

Technical ContextAI

Alexantr filemanager is a small, standalone PHP-based web file manager; the affected entry point is filemanager.php. The weakness is CWE-94 (Improper Control of Generation of Code, i.e. code injection), meaning attacker-controlled input is incorporated into something the PHP interpreter (or a downstream evaluator) executes - common roots in this class include eval()/preg_replace /e/ callbacks, dynamic include of user-controlled paths, or unsanitized parameters passed to system/exec. The supplied CPE is the placeholder 'cpe:2.3:a:n/a:n/a:*' (n/a), so NVD has not bound this to a normalized vendor/product entry, and the exact injected sink cannot be confirmed from the available data.

RemediationAI

No vendor-released patch identified at time of analysis and no fixed version is cited in the available data, so do not assume a fixed release exists. As specific compensating controls: remove filemanager.php from any internet-facing deployment or restrict access to it behind authentication and an IP allowlist at the web server level (trade-off: breaks legitimate remote file management); if the component must remain, place it behind a WAF rule blocking code-injection payloads to the affected parameters (trade-off: bypassable, not a real fix); and run the PHP process with least privilege and disable dangerous PHP functions via disable_functions (e.g. eval is not disablable, but exec/system/passthru can be) to limit blast radius (trade-off: may break intended features). Monitor the referenced GitHub repository (https://github.com/SLO-CYBER-SEC/CVE-2026-37637) and the upstream Alexantr project for a patched release, and given this is a small unmaintained-style project, strongly consider migrating to an actively maintained file manager.