CVE-2018-15536 /filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary fi...

MediumCVSS 5.5 EPSS 6.3% Public exploit

Published: 2018-08-24 22:00
Updated: 2026-06-17 04:42
Exploit status: Public exploit available

Description

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal.

Affected products

Product	Affected versions	Fixed in
Tecrail Responsive FileManager	< 9.13.4	9.13.4

References

20180821 RESPONSIVE filemanager exploit mailing-list third-party-advisory
45271 exploit third-party-advisory vdb-entry

CVSS v3.0

5.5 Medium

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

All scores (2)

v3.0 5.5 · nvd@nist.gov
v2.0 5.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 6.33% (percentile 93.7)
CWE: CWE-22

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Responsive FileManager < 9.13.4 - Directory Traversal Exploit · Exploit Database (OffSec) · 2018-08-27