CVE-2026-37266

Vulnerability

An issue in Responsive FileManager version 9.14.0 allows a remote attacker to exploit a Local File Inclusion (LFI) and arbitrary file creation vulnerability via the force_download.php component and the name parameter [1][2]. The software is a PHP-based file manager that handles file storage and retrieval. Version 9.14.0 is affected; the project has been discontinued and no fixes are available [1][2].

Exploitation

An attacker can send a crafted HTTP request to filemanager/force_download.php with a malicious name parameter containing path traversal sequences (e.g., ../../../etc/passwd) to read arbitrary files from the server [2]. No authentication is required because the file manager's uploaded content is intended to be publicly accessible. Additionally, the attacker can upload files of arbitrary types (including PHP scripts) despite built-in controls, leading to remote code execution [2].

Impact

Successful exploitation allows an unauthenticated remote attacker to read sensitive files (e.g., passwords, configuration details, source code) and create arbitrary files on the server, potentially leading to full host compromise, data breaches, and service disruption [2]. The LFI can serve as a stepping stone for further attacks [2].

Mitigation

No patch is available; Responsive FileManager version 9.14.0 is the final release and the project has been discontinued [1][2]. The only effective mitigation is to disable or remove the component entirely and migrate to an actively maintained alternative file manager [2].