CVE-2026-18788
Received Received - Intake

Unrestricted File Upload in Trippo ResponsiveFilemanager

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulDB

Description
A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18788
EUVD
EUVD-2026-52798

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
trippo responsivefilemanager to 9.14.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18788 is an unauthenticated unrestricted file upload vulnerability in Trippo ResponsiveFilemanager up to version 9.14.0. The flaw exists in the filemanager/dialog.php component, allowing attackers to upload arbitrary files without authentication. This can lead to remote code execution or other malicious activities depending on the uploaded content.

Detection Guidance

To detect this vulnerability, check if ResponsiveFilemanager 9.14.0 or earlier is running and accessible. Test for unauthenticated file uploads by sending a request to /filemanager/dialog.php to initialize a session, then attempt to create a file via /filemanager/execute.php?action=create_file with a .html, .htm, or .js extension. If successful, the file should be publicly accessible under /source/. Use the provided PoC in a controlled environment for safe testing.

  • Run: curl -X GET http://<target>/filemanager/dialog.php to check if the endpoint is accessible.
  • Send: curl -X POST http://<target>/filemanager/execute.php?action=create_file -d 'filename=test.html&content=<script>alert(1)</script>' to test file creation.
  • Verify by accessing: http://<target>/source/test.html to confirm public access.
Impact Analysis

This vulnerability allows attackers to upload malicious files like HTML, JavaScript, or PHP to your server. These files can be used for cross-site scripting (XSS), phishing attacks, SEO spam, or even full server compromise if executable code is uploaded. The attack can be performed remotely without any authentication.

Compliance Impact

This vulnerability can lead to data breaches, unauthorized access, and data exfiltration, which are direct violations of GDPR and HIPAA. Compliance requires protecting personal and health data, and this flaw undermines those protections by allowing attackers to upload malicious content or access sensitive files.

Mitigation Strategies

Immediately upgrade to a patched version of ResponsiveFilemanager if available. Disable public file creation for HTML, JS, and HTM files by setting USE_ACCESS_KEYS to true or enforcing authentication. Review and remove any unauthorized files in the /source/ directory. Block external access to /filemanager/execute.php and /filemanager/dialog.php if not required.

  • Enable authentication and access keys in the configuration file.
  • Restrict file uploads to authenticated users only.
  • Audit and delete any suspicious files in the /source/ directory.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18788. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart