VORANT. Threat Intelligence Research Create a free account

Tecrail FileManager RCE via unrestricted upload

Published Vorant ratingroutine vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

CVE-2026-5482 allows unauthenticated remote code execution in unmaintained Responsive FileManager 9.14.0 via unrestricted file upload through dialog.php endpoint.

Sourcecert.pl — open the original

What to check

Applies to
The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation
No exploitation in the wild and no public exploit is recorded for the CVEs named.

CERT Polska has coordinated disclosure of a critical vulnerability in Tecrail Responsive FileManager, identified as CVE-2026-5482. The flaw permits unauthenticated attackers to upload arbitrary files without any type or extension restrictions through the dialog.php endpoint, enabling remote code execution on affected systems. The vulnerability affects the latest release version 9.14.0.

The project is unmaintained as of the CVE assignment date, meaning no official patch is expected. Organizations running Responsive FileManager should consider migrating to actively maintained alternatives or implementing compensating controls such as removing public access to the affected endpoints.

The vulnerability was responsibly disclosed by security researchers Kamil Szczurowski and Robert Kruczek through CERT Polska's coordinated vulnerability disclosure process.

Mentioned in this report

Vulnerabilities CVE-2026-5482

Related reporting

Detection guidance

Tecrail FileManager Unauthenticated File Upload to dialog.php

ATT&CK T1190 · status experimental · needs webserver logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects HTTP POST requests to the Responsive FileManager dialog.php endpoint carrying upload/file parameters, indicative of exploitation of CVE-2026-5482 unrestricted upload vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Tecrail FileManager Unauthenticated File Upload to dialog.php
id: be6f3e95-4f76-5a97-bcc3-b0bbc1816d5a
status: experimental
description: Detects HTTP POST requests to the Responsive FileManager dialog.php endpoint
  containing upload-related parameters, matching the exploitation pattern for CVE-2026-5482
  which allows unauthenticated arbitrary file upload.
references:
- CERT Polska CVE-2026-5482 advisory
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|endswith: /dialog.php
  upload_query:
    cs-uri-query|contains:
    - action=upload
    - type=upload
    - upload
  condition: selection and upload_query
falsepositives:
- Legitimate file uploads performed by authenticated administrators using the FileManager
  plugin
- Automated vulnerability scanning by authorized security teams
level: high
tags:
- attack.t1190
author: Vorant

Web Server Process Spawning Shell After FileManager Exploitation

ATT&CK T1505.003 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects a web server or PHP process spawning a command shell, consistent with execution of a webshell uploaded via the Tecrail FileManager RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Shell After FileManager Exploitation
id: 1b052d3d-7854-54b6-b7ae-402f36258e03
status: experimental
description: Detects command or script interpreters spawned directly by a web server
  or PHP process, a common post-exploitation pattern following upload of a webshell
  through vulnerable file manager endpoints such as the Tecrail FileManager dialog.php
  (CVE-2026-5482).
references:
- CERT Polska CVE-2026-5482 advisory
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\php-cgi.exe
    - \\php.exe
    - \\httpd.exe
    - \\nginx.exe
    - \\w3wp.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\pwsh.exe
    - \\wscript.exe
    - \\cscript.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate PHP applications that intentionally shell out to system utilities for
  scheduled maintenance
- Administrative scripts executed through IIS or Apache management tooling
level: high
tags:
- attack.t1505.003
- attack.t1190
- attack.persistence
author: Vorant

Script File Dropped in FileManager Upload Directory

ATT&CK T1505.003 · status experimental · needs windows file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects creation of executable script files (php, phtml, jsp, asp, aspx) within web-accessible upload directories typically used by Responsive FileManager, indicating potential webshell deployment via CVE-2026-5482. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Script File Dropped in FileManager Upload Directory
id: a2158333-b505-5f8b-9f69-a42a3c45497c
status: experimental
description: Detects creation of script files with executable server-side extensions
  within directories commonly used for uploads by Responsive FileManager (e.g. /uploads/,
  /filemanager/, /userfiles/), consistent with webshell placement following exploitation
  of CVE-2026-5482.
references:
- CERT Polska CVE-2026-5482 advisory
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
    - \\uploads\\
    - \\filemanager\\
    - \\userfiles\\
  selection_ext:
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
    - .jsp
    - .asp
    - .aspx
  condition: selection_path and selection_ext
falsepositives:
- Legitimate deployment of PHP or ASP application files by developers through the
  FileManager interface
- CMS plugin or theme updates that write script files into upload directories
level: medium
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-5482

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs