{"id":"CVE-2026-5482","state":"PUBLISHED","title":"Remote Code Execution via Unrestricted File Upload in Responsive FileManager","description":"Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. \n\nThis project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0","publishedAt":"2026-06-15T11:44:46.963Z","updatedAt":"2026-06-15T12:32:39.368Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","source":"CERT-PL"},"assigner":"CERT-PL","products":["Tecrail Responsive FileManager"],"affected":[{"vendor":"Tecrail","product":"Responsive FileManager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"9.14.0","versionType":"semver"}],"programFiles":["filemanager/dialog.php"],"repo":"https://github.com/trippo/ResponsiveFilemanager"}],"references":["https://cert.pl/en/posts/2026/06/CVE-2026-5482","https://github.com/trippo/ResponsiveFilemanager"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5482.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5482","state":"PUBLISHED","datePublished":"2026-06-15T11:44:46.963Z","dateUpdated":"2026-06-15T12:32:39.368Z","assignerShortName":"CERT-PL","assignerOrgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateReserved":"2026-04-03T09:53:14.018Z"},"containers":{"cna":{"title":"Remote Code Execution via Unrestricted File Upload in Responsive FileManager","descriptions":[{"lang":"en","value":"Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. \n\nThis project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0"}],"affected":[{"vendor":"Tecrail","product":"Responsive FileManager","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"9.14.0","versionType":"semver"}],"programFiles":["filemanager/dialog.php"],"repo":"https://github.com/trippo/ResponsiveFilemanager"}],"references":[{"url":"https://cert.pl/en/posts/2026/06/CVE-2026-5482","tags":["third-party-advisory"]},{"url":"https://github.com/trippo/ResponsiveFilemanager","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERT-PL","orgId":"4bb8329e-dd38-46c1-aafb-9bf32bcb93c6","dateUpdated":"2026-06-15T11:44:46.963Z"},"credits":[{"lang":"en","type":"finder","value":"Kamil Szczurowski"},{"lang":"en","type":"finder","value":"Robert Kruczek"}],"datePublic":"2026-06-15T11:44:00.000Z","source":{"discovery":"EXTERNAL"},"tags":["unsupported-when-assigned","x_open-source"],"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-15T12:32:30.749356Z","id":"CVE-2026-5482","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-15T12:32:39.368Z"}}]}}}