Unauthenticated RCE flaw in Responsive FileManager
An unauthenticated file upload vulnerability in Tecrail Responsive FileManager 9.14.0 allows remote code execution, and the project is unmaintained.
CERT Polska coordinated disclosure of CVE-2026-5482, a vulnerability in Tecrail Responsive FileManager, a PHP-based file management library commonly embedded in CMS and web applications. The flaw resides in the dialog.php endpoint, which fails to restrict file types or extensions during upload, allowing an unauthenticated attacker to upload arbitrary files, including web shells, leading to remote code execution on the host server.
The vulnerability affects the latest release, version 9.14.0, and the project is confirmed to be unmaintained at the time of CVE assignment, meaning no patch is expected from the upstream maintainer. Organizations using Responsive FileManager should identify instances, restrict access to the dialog.php endpoint, or migrate to an actively maintained alternative. The report was credited to researchers Kamil Szczurowski and Robert Kruczek through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Web Server Process Spawning Shell After Responsive FileManager Exploitation
Detects a web server/PHP process (as used by Responsive FileManager deployments) spawning a command shell or interpreter, consistent with execution of an uploaded web shell following exploitation of the dialog.php unrestricted upload flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell After Possible Web Shell Upload
description: Detects PHP-FPM, Apache, or IIS worker processes spawning command interpreters,
a common post-exploitation pattern after an unauthenticated file upload RCE (e.g.
CVE-2026-5482 in Responsive FileManager dialog.php) is used to drop a web shell.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \php-cgi.exe
- \php.exe
- \php-fpm.exe
- \httpd.exe
- \apache.exe
- \nginx.exe
- \w3wp.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh
- \bash
- \whoami.exe
- \net.exe
filter_common_admin:
CommandLine|contains:
- phpinfo
- composer
condition: selection and not filter_common_admin
falsepositives:
- Legitimate PHP applications that shell out to system utilities (e.g. imagemagick
wrappers, backup scripts)
- Web application health-check or diagnostic scripts invoking system commands
level: high
id: 13179e65-77b6-5fef-9876-ba71574727ab
status: experimental
author: Vorant
Script File Written into FileManager Upload Directory by Web Server Process
Detects creation of executable script files (php/phtml/phar/asp/jsp) inside file manager upload directories by a web server process, indicative of an unrestricted file upload being abused to plant a web shell (e.g. via Responsive FileManager dialog.php). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable Script Dropped in FileManager Upload Path
description: Detects a web server or PHP interpreter process writing a script file
with an executable server-side extension into an upload/filemanager directory. Generalises
on process-writing-executable-script behaviour rather than a specific filename,
matching the unrestricted upload pattern exploited in CVE-2026-5482.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \php-cgi.exe
- \php.exe
- \php-fpm.exe
- \httpd.exe
- \apache.exe
- \nginx.exe
- \w3wp.exe
TargetFilename|contains:
- upload
- filemanager
- file_manager
TargetFilename|endswith:
- .php
- .phtml
- .phar
- .asp
- .aspx
- .jsp
condition: selection
falsepositives:
- Legitimate CMS plugin installation or theme upload workflows that write PHP files
to upload directories
- Automated deployment tooling that pushes application code through the same web-accessible
directories
level: high
id: d23e8dc0-3923-50d6-8a4b-03e437b4f909
status: experimental
author: Vorant
POST Request to Responsive FileManager dialog.php Upload Endpoint
Detects HTTP POST requests to the dialog.php endpoint of Responsive FileManager, the vulnerable upload handler in CVE-2026-5482 that allows unauthenticated arbitrary file upload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: POST to Responsive FileManager dialog.php Endpoint
description: Flags POST requests targeting the dialog.php endpoint used by Responsive
FileManager for file operations including upload. Combined with unusual source IPs,
absence of session/auth cookies, or repeated calls, this endpoint is the vector
for CVE-2026-5482 unrestricted file upload RCE.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /dialog.php
condition: selection
falsepositives:
- Legitimate authenticated file manager usage by CMS administrators or content editors
- Automated integration tests exercising the file manager component in staging environments
level: medium
id: 5140a349-c508-5127-a96f-67716b947d3f
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-5482
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free