CVE-2026-5482: Remote Code Execution via Unrestricted File Upload in Responsive FileManager

Synopsis

An unrestricted file upload vulnerability in Responsive FileManager (versions up to and including 9.14.0) allows any unauthenticated attacker to upload arbitrary files, including server-side scripts, through the dialog.php endpoint. The attack is reachable over the network and requires no credentials or user interaction. Successful exploitation gives the attacker remote code execution on the host running the application. No fix version has been published; the project is unmaintained, and HarborGuard tracks the advisory for any future patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the application's dialog.php endpoint over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or session credential of any privilege level is required to trigger the upload.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link, open a file, or take any action.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions, memory-layout dependencies, or environmental factors to overcome.

Blast Radius

• The attacker uploads and executes arbitrary server-side code, gaining a remote shell on the host running Responsive FileManager.
• With code execution established, the attacker reads any file accessible to the web server process, including application secrets, credentials, and stored user data.
• The attacker modifies or deletes files on the server, including application code, configuration files, and persisted data.
• Secondary systems reachable from the compromised host are exposed to lateral movement, reflected in the low-severity impact scores on scope components in the CVSS vector.