CVE-2026-5482

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-5482

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5482.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-5482

Published

2026-06-15T11:44:46.963Z

Modified

2026-07-15T01:49:01.208697902Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L CVSS Calculator

Summary

Remote Code Execution via Unrestricted File Upload in Responsive FileManager

Details

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.

This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

Database specific

{
    "cwe_ids": [
        "CWE-434"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5482.json",
    "cna_assigner": "CERT-PL"
}

References

Affected packages

Git / github.com/trippo/responsivefilemanager

Affected ranges

Type

GIT

Repo

https://github.com/trippo/responsivefilemanager

Events

Introduced

Last affected

d5572d2c645c9eebf0a9fcb9f3e6d23722d454f4

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.14.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

9.*

9.9

9.9.1

9.9.2

9.9.4

v.*

v.9.10.1

v9.*

v9.10.0

v9.10.1

v9.10.2

v9.11.0

v9.11.3

v9.12.0

v9.12.1

v9.12.2

v9.13.0

v9.13.1

v9.13.3

v9.13.4

v9.14.0

v9.9.3

v9.9.4

v9.9.5

v9.9.6

v9.9.7

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5482.json"