Tecrail FileManager RCE via unrestricted upload

15 June 2026 critical vulnerability

CVE-2026-5482 allows unauthenticated remote code execution in unmaintained Responsive FileManager 9.14.0 via unrestricted file upload through dialog.php endpoint.

CERT Polska has coordinated disclosure of a critical vulnerability in Tecrail Responsive FileManager, identified as CVE-2026-5482. The flaw permits unauthenticated attackers to upload arbitrary files without any type or extension restrictions through the dialog.php endpoint, enabling remote code execution on affected systems. The vulnerability affects the latest release version 9.14.0.

The project is unmaintained as of the CVE assignment date, meaning no official patch is expected. Organizations running Responsive FileManager should consider migrating to actively maintained alternatives or implementing compensating controls such as removing public access to the affected endpoints.

The vulnerability was responsibly disclosed by security researchers Kamil Szczurowski and Robert Kruczek through CERT Polska's coordinated vulnerability disclosure process.

Mentioned in this report

Vulnerabilities CVE-2026-5482

Detection guidance

Tecrail FileManager Unauthenticated File Upload to dialog.php

ATT&CK T1190

Detects HTTP POST requests to the Responsive FileManager dialog.php endpoint carrying upload/file parameters, indicative of exploitation of CVE-2026-5482 unrestricted upload vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Tecrail FileManager Unauthenticated File Upload to dialog.php
id: be6f3e95-4f76-5a97-bcc3-b0bbc1816d5a
status: experimental
description: Detects HTTP POST requests to the Responsive FileManager dialog.php endpoint
  containing upload-related parameters, matching the exploitation pattern for CVE-2026-5482
  which allows unauthenticated arbitrary file upload.
references:
- CERT Polska CVE-2026-5482 advisory
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|endswith: /dialog.php
  upload_query:
    cs-uri-query|contains:
    - action=upload
    - type=upload
    - upload
  condition: selection and upload_query
falsepositives:
- Legitimate file uploads performed by authenticated administrators using the FileManager
  plugin
- Automated vulnerability scanning by authorized security teams
level: high
tags:
- attack.t1190
- attack.exploit-public-facing-application
author: Vorant

Web Server Process Spawning Shell After FileManager Exploitation

ATT&CK T1505.003

Detects a web server or PHP process spawning a command shell, consistent with execution of a webshell uploaded via the Tecrail FileManager RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell After FileManager Exploitation
id: 1b052d3d-7854-54b6-b7ae-402f36258e03
status: experimental
description: Detects command or script interpreters spawned directly by a web server
  or PHP process, a common post-exploitation pattern following upload of a webshell
  through vulnerable file manager endpoints such as the Tecrail FileManager dialog.php
  (CVE-2026-5482).
references:
- CERT Polska CVE-2026-5482 advisory
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\php-cgi.exe
    - \\php.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\w3wp.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\wscript.exe
    - \\cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate PHP applications that intentionally shell out to system utilities for
  scheduled maintenance
- Administrative scripts executed through IIS or Apache management tooling
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.persistence
author: Vorant

Script File Dropped in FileManager Upload Directory

ATT&CK T1505.003

Detects creation of executable script files (php, phtml, jsp, asp, aspx) within web-accessible upload directories typically used by Responsive FileManager, indicating potential webshell deployment via CVE-2026-5482. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Script File Dropped in FileManager Upload Directory
id: a2158333-b505-5f8b-9f69-a42a3c45497c
status: experimental
description: Detects creation of script files with executable server-side extensions
  within directories commonly used for uploads by Responsive FileManager (e.g. /uploads/,
  /filemanager/, /userfiles/), consistent with webshell placement following exploitation
  of CVE-2026-5482.
references:
- CERT Polska CVE-2026-5482 advisory
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
    - \\uploads\\
    - \\filemanager\\
    - \\userfiles\\
  selection_ext:
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
    - .jsp
    - .asp
    - .aspx
  condition: selection_path and selection_ext
falsepositives:
- Legitimate deployment of PHP or ASP application files by developers through the
  FileManager interface
- CMS plugin or theme updates that write script files into upload directories
level: medium
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-5482

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free