CVE-2026-5482CWE-434

Remote Code Execution via Unrestricted File Upload in Responsive FileManager

Critical · published June 15, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.

This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.00709 · 52.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-06-15T11:44Z
EPSS history
Timeline
  • 15 JUN 11:44Z
    Remote Code Execution via Unrestricted File Upload in Responsive FileManager
    cvelistv5