CVE-2026-37266: An issue in Responsive File Manager Responsive FileManager Version 9

Synopsis

Remote code execution vulnerability in Responsive FileManager version 9.14.0 is reachable over the network by any authenticated user with low-privilege access, and requires a victim to take some action to trigger it. Successful exploitation gives an attacker full control over the affected system, including reading, modifying, and destroying data or crashing the service. The vulnerability exists in the force_download.php component. HarborGuard tracks this advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable service over the network; no local or physical access is needed.

• AuthenticationRequired

  The attacker must hold a valid low-privilege account on the application; unauthenticated access is not sufficient.

• Victim interactionRequired

  A victim user must perform some action (such as following a crafted link or triggering a download) to complete exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental factors.

Blast Radius

• An attacker achieves remote code execution on the host running Responsive FileManager, gaining the ability to run arbitrary commands.
• Confidential data stored on the server, including files managed by the application, is fully readable by the attacker.
• The attacker can modify or delete any files and data the application process has access to.
• The attacker can crash or otherwise disable the affected service, causing a denial of service for users.