Arbitrary file upload in Tecrail Responsive Filemanager

CVE-2026-5482

Responsive FileManager's allows an unauthenticated attacker to upload files of any type and extension without restriction using dialog.php endpoint, leading to Remote Code Execution.  This project is unmaintained at the time of CVE assignment. The vulnerability was found in the latest release 9.14.0

Vulnerability class: Unrestricted File Upload

Published · last modified .

EPSS exploit prediction

EPSS: 0.004 (38.7th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2026-5482: held from 0.007 to 0.004.

EPSS over last 30 days · oldest: 0.007 · newest: 0.004 · change: -0.003

Affected products

Weakness classification (CWE)

References