CVE-2026-5482

critical · 9.3

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution. This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

9.3

CVSS

0.4%

EPSS (exploit prob.)

38th

EPSS percentile

2026-06-15

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-434

References

https://cert.pl/en/posts/2026/06/CVE-2026-5482
https://github.com/trippo/ResponsiveFilemanager

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-5482