CVE-2026-18788

Description

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

Overview

State: PUBLISHED
Assigner (CNA): VulDB
CVSS severity: MEDIUM
CVSS score: 6.9 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Effective score: 6.9 / 10 MEDIUM source: CNA overview
CWE(s): CWE-434, CWE-284
Reserved: 2026-08-04
Published: 2026-08-04 17:15 UTC
Last updated: 2026-08-04 17:15 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/18xxx/CVE-2026-18788.json

Affected products (1)

Vendor	Product	Versions	Platforms
Trippo	ResponsiveFilemanager	`9.0` (affected), `9.1` (affected), `9.2` (affected), `9.3` (affected), `9.4` (affected), `9.5` (affected), `9.6` (affected), `9.7` (affected), `9.8` (affected), `9.9` (affected), `9.10` (affected), `9.11` (affected), `9.12` (affected), `9.13` (affected), `9.14.0` (affected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

VDB-385789 | Trippo ResponsiveFilemanager dialog.php unrestricted upload vdb-entry
VDB-385789 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
CVE-2026-18788 | CVE Analysis and Report third-party-advisory
Submit #857485 | ResponsiveFilemanager / trippo ResponsiveFilemanager 51eddae5190cfc4408ade40575ee63404fead0b9 Unrestricted File Upload / Missing Authentication third-party-advisory
Submit #858233 | trippo / Alberto Peripolli ResponsiveFilemanager 9.14.0 Missing Authorization (Duplicate) third-party-advisory
https://github.com/fa1c4/security-advisories/tree/main/responsivefilemanager/PoC exploit
https://github.com/sjmycz/cve/issues/8 exploitissue-tracking

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-18788.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:trippo:responsivefilemanager:*:*:*:*:*:*:*:*"
          ],
          "product": "ResponsiveFilemanager",
          "vendor": "Trippo",
          "versions": [
            {
              "status": "affected",
              "version": "9.0"
            },
            {
              "status": "affected",
              "version": "9.1"
            },
            {
              "status": "affected",
              "version": "9.2"
            },
            {
              "status": "affected",
              "version": "9.3"
            },
            {
              "status": "affected",
              "version": "9.4"
            },
            {
              "status": "affected",
              "version": "9.5"
            },
            {
              "status": "affected",
              "version": "9.6"
            },
            {
              "status": "affected",
              "version": "9.7"
            },
            {
              "status": "affected",
              "version": "9.8"
            },
            {
              "status": "affected",
              "version": "9.9"
            },
            {
              "status": "affected",
              "version": "9.10"
            },
            {
              "status": "affected",
              "version": "9.11"
            },
            {
              "status": "affected",
              "version": "9.12"
            },
            {
              "status": "affected",
              "version": "9.13"
            },
            {
              "status": "affected",
              "version": "9.14.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "fa1c4 (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 7.5,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-04T17:15:08.777Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-385789 | Trippo ResponsiveFilemanager dialog.php unrestricted upload",
          "tags": [
            "vdb-entry"
          ],
          "url": "https://vuldb.com/vuln/385789"
        },
        {
          "name": "VDB-385789 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/385789/cti"
        },
        {
          "name": "CVE-2026-18788 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-18788"
        },
        {
          "name": "Submit #857485 | ResponsiveFilemanager / trippo ResponsiveFilemanager 51eddae5190cfc4408ade40575ee63404fead0b9 Unrestricted File Upload / Missing Authentication",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/857485"
        },
        {
          "name": "Submit #858233 | trippo / Alberto Peripolli ResponsiveFilemanager 9.14.0 Missing Authorization (Duplicate)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/858233"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/fa1c4/security-advisories/tree/main/responsivefilemanager/PoC"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/sjmycz/cve/issues/8"
        }
      ],
      "tags": [
        "unsupported-when-assigned"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-04T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-04T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-04T10:42:03.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "Trippo ResponsiveFilemanager dialog.php unrestricted upload",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-18788",
    "datePublished": "2026-08-04T17:15:08.777Z",
    "dateReserved": "2026-08-04T08:36:57.685Z",
    "dateUpdated": "2026-08-04T17:15:08.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}