# Unauthenticated RCE flaw in Responsive FileManager

Published: 2026-06-15 · Severity: high
Canonical: https://vorant.io/reports/9a281417-2b26-5315-b118-3d5be0c845fd/unauthenticated-rce-flaw-in-responsive-filemanager

> An unauthenticated file upload vulnerability in Tecrail Responsive FileManager 9.14.0 allows remote code execution, and the project is unmaintained.

CERT Polska coordinated disclosure of CVE-2026-5482, a vulnerability in Tecrail Responsive FileManager, a PHP-based file management library commonly embedded in CMS and web applications. The flaw resides in the dialog.php endpoint, which fails to restrict file types or extensions during upload, allowing an unauthenticated attacker to upload arbitrary files, including web shells, leading to remote code execution on the host server.

The vulnerability affects the latest release, version 9.14.0, and the project is confirmed to be unmaintained at the time of CVE assignment, meaning no patch is expected from the upstream maintainer. Organizations using Responsive FileManager should identify instances, restrict access to the dialog.php endpoint, or migrate to an actively maintained alternative. The report was credited to researchers Kamil Szczurowski and Robert Kruczek through CERT Polska's coordinated vulnerability disclosure process.

## Mentioned in this report

- Vulnerabilities: CVE-2026-5482

## Detection guidance (public sample)

### Web Server Process Spawning Shell After Responsive FileManager Exploitation

ATT&CK: T1505.003

Detects a web server/PHP process (as used by Responsive FileManager deployments) spawning a command shell or interpreter, consistent with execution of an uploaded web shell following exploitation of the dialog.php unrestricted upload flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Shell After Possible Web Shell Upload
description: Detects PHP-FPM, Apache, or IIS worker processes spawning command interpreters,
  a common post-exploitation pattern after an unauthenticated file upload RCE (e.g.
  CVE-2026-5482 in Responsive FileManager dialog.php) is used to drop a web shell.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php.exe
    - \php-fpm.exe
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    - \w3wp.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \sh
    - \bash
    - \whoami.exe
    - \net.exe
  filter_common_admin:
    CommandLine|contains:
    - phpinfo
    - composer
  condition: selection and not filter_common_admin
falsepositives:
- Legitimate PHP applications that shell out to system utilities (e.g. imagemagick
  wrappers, backup scripts)
- Web application health-check or diagnostic scripts invoking system commands
level: high
id: 13179e65-77b6-5fef-9876-ba71574727ab
status: experimental
author: Vorant
```

### Script File Written into FileManager Upload Directory by Web Server Process

ATT&CK: T1505.003

Detects creation of executable script files (php/phtml/phar/asp/jsp) inside file manager upload directories by a web server process, indicative of an unrestricted file upload being abused to plant a web shell (e.g. via Responsive FileManager dialog.php). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Executable Script Dropped in FileManager Upload Path
description: Detects a web server or PHP interpreter process writing a script file
  with an executable server-side extension into an upload/filemanager directory. Generalises
  on process-writing-executable-script behaviour rather than a specific filename,
  matching the unrestricted upload pattern exploited in CVE-2026-5482.
tags:
- attack.persistence
- attack.t1505.003
- attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \php-cgi.exe
    - \php.exe
    - \php-fpm.exe
    - \httpd.exe
    - \apache.exe
    - \nginx.exe
    - \w3wp.exe
    TargetFilename|contains:
    - upload
    - filemanager
    - file_manager
    TargetFilename|endswith:
    - .php
    - .phtml
    - .phar
    - .asp
    - .aspx
    - .jsp
  condition: selection
falsepositives:
- Legitimate CMS plugin installation or theme upload workflows that write PHP files
  to upload directories
- Automated deployment tooling that pushes application code through the same web-accessible
  directories
level: high
id: d23e8dc0-3923-50d6-8a4b-03e437b4f909
status: experimental
author: Vorant
```

### POST Request to Responsive FileManager dialog.php Upload Endpoint

ATT&CK: T1190

Detects HTTP POST requests to the dialog.php endpoint of Responsive FileManager, the vulnerable upload handler in CVE-2026-5482 that allows unauthenticated arbitrary file upload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: POST to Responsive FileManager dialog.php Endpoint
description: Flags POST requests targeting the dialog.php endpoint used by Responsive
  FileManager for file operations including upload. Combined with unusual source IPs,
  absence of session/auth cookies, or repeated calls, this endpoint is the vector
  for CVE-2026-5482 unrestricted file upload RCE.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: /dialog.php
  condition: selection
falsepositives:
- Legitimate authenticated file manager usage by CMS administrators or content editors
- Automated integration tests exercising the file manager component in staging environments
level: medium
id: 5140a349-c508-5127-a96f-67716b947d3f
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/06/CVE-2026-5482

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9a281417-2b26-5315-b118-3d5be0c845fd/unauthenticated-rce-flaw-in-responsive-filemanager.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup