CVE-2026-37637: An issue in Alexantr filemanager v

Synopsis

An unauthenticated remote code execution vulnerability affects Alexantr filemanager v.1.0. The flaw is reachable over the network with no credentials required and no victim interaction needed, making it trivially exploitable by any remote attacker who can reach the service. Successful exploitation lets the attacker run arbitrary code on the host, with full read and write access to data handled by the application. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the filemanager.php endpoint over the network; any internet-exposed or internally reachable deployment is in scope.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable endpoint accepts unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully remote and automated; no user needs to click a link or open a file.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific preconditions.

Blast Radius

• The attacker executes arbitrary code in the context of the web server process running filemanager.php.
• High confidentiality impact means the attacker reads any file accessible to that process, including configuration files, credentials, and uploaded content.
• High integrity impact means the attacker writes, overwrites, or deletes files on the host, which can be used to plant web shells or tamper with application data.
• Availability is not directly impacted per the CVSS vector, though arbitrary code execution in practice can be used to disrupt service at the attacker's discretion.