Which versions of Responsive FileManager are affected by CVE-2026-5482?

Responsive FileManager 9.14.0 allows unauthenticated remote attackers to upload arbitrary files and execute code on affected web servers.

How to fix or mitigate CVE-2026-5482?

Within 24 hours: Identify all instances of Responsive FileManager 9.14.0 and earlier, document exposure (internet-facing or internal), and search logs for suspicious upload activity. Within 7 days: Disable the dialog.php endpoint via web server configuration, deploy WAF rules blocking uploads to vulnerable paths, and restrict network access to the application. Within 30 days: Migrate to a maintained alternative file manager or fully decommission-do not delay mitigation given the absence of vendor support.

Responsive FileManager CVE-2026-5482

Q: What is the CVSS score of CVE-2026-5482?

CVE-2026-5482 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-36716 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-15 CERT-PL

GHSA-3pvv-gjhm-83qj

File Upload PHP RCE Responsive Filemanager

9.3

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network upload to dialog.php yields RCE with no user interaction, giving full C/I/A impact on the web server; scope unchanged within the PHP host.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 12:20 vuln.today

DescriptionCVE.org

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.

This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

Articles & Coverage 1

News Critical Unrestricted File Upload RCE in Responsive FileManager 9.14.0 - CVE-2026-5482 Jun 15, 2026

AnalysisAI

Unrestricted file upload in Responsive FileManager 9.14.0 (and likely earlier) allows remote unauthenticated attackers to upload arbitrary files - including PHP scripts - via the dialog.php endpoint, leading directly to remote code execution on the hosting web server. The project is unmaintained at the time of CVE assignment, so no vendor patch is forthcoming, and while no public exploit is identified at time of analysis the trivial nature of unrestricted file upload makes weaponization straightforward.

Technical ContextAI

Responsive FileManager (tecrail/trippo ResponsiveFilemanager per the CPE and GitHub reference) is a widely embedded open-source PHP file manager commonly integrated into TinyMCE, CKEditor and CMS plugins to provide browse/upload UI. The flaw is CWE-434 (Unrestricted Upload of File with Dangerous Type): the dialog.php upload handler fails to enforce an allow-list on file extension and MIME type, so an attacker can place a .php (or equivalent server-interpreted) file into a web-served directory. Because the file lands inside the application's PHP execution context, requesting it causes the PHP interpreter to run attacker-controlled code as the web server user.

RemediationAI

No vendor-released patch identified at time of analysis - the project is unmaintained - so the durable fix is to remove Responsive FileManager and migrate to a maintained alternative such as elFinder or a framework-native upload component. Until removal is possible, deny external access to dialog.php (and the broader filemanager/ path) at the web server or WAF (e.g., return 403 for /filemanager/dialog.php and /filemanager/upload.php), restrict the upload directory to deny PHP execution via Apache 'php_admin_flag engine off' or nginx 'location ~ \.php$ { return 403; }' inside the uploads path, and enforce a strict server-side extension allow-list in any wrapper code; each of these breaks the upload-and-execute chain but will also break legitimate WYSIWYG upload flows that depend on the component. Monitor the CERT-PL advisory at https://cert.pl/en/posts/2026/06/CVE-2026-5482 and https://github.com/trippo/ResponsiveFilemanager for any community fork or backport before re-enabling the feature.