{"id":"CVE-2022-46604","aliases":["EUVD-2022-49408","GHSA-q3q6-m34m-pq3r"],"status":"published","title":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file...","description":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.08627,"percentile":0.95143,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2023-02-02T00:00:00Z","modified":"2026-10-28T02:30:54Z","exploits":[{"source":"exploitdb","id":"EDB-51251","title":"Responsive FileManager 9.9.5 - Remote Code Execution (RCE)","type":"webapps","platform":"php","date":"2023-04-05","verified":true,"url":"https://www.exploit-db.com/exploits/51251"},{"source":"pocgithub","id":"CyberQuestor-infosec/CVE-2022-46604-Responsive-File-Manager","title":"CyberQuestor-infosec/CVE-2022-46604-Responsive-File-Manager","date":"2025-06-05","url":"https://github.com/CyberQuestor-infosec/CVE-2022-46604-Responsive-File-Manager"},{"source":"pocgithub","id":"galoget/ResponsiveFileManager-CVE-2022-46604","title":"galoget/ResponsiveFileManager-CVE-2022-46604","date":"2023-02-03","url":"https://github.com/galoget/ResponsiveFileManager-CVE-2022-46604"}],"products":[{"vendor":"tecrail","product":"responsive_filemanager"}],"references":[{"url":"https://medium.com/%40_sadshade/file-extention-bypass-in-responsive-filemanager-9-5-5-leading-to-rce-authenticated-3290eddc54e7","tags":["x_transferred","web"]},{"url":"https://github.com/trippo/ResponsiveFilemanager/blob/v9.9.5/filemanager/execute.php","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/trippo/ResponsiveFilemanager/blob/v9.9.6/changelog.txt","tags":["x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/171720/Responsive-FileManager-9.9.5-Remote-Shell-Upload.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46604","tags":["advisory"]},{"url":"https://medium.com/@_sadshade/file-extention-bypass-in-responsive-filemanager-9-5-5-leading-to-rce-authenticated-3290eddc54e7"},{"url":"https://github.com/advisories/GHSA-q3q6-m34m-pq3r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46604.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-46604","description":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.","status":"published","published":"2023-02-02T00:00:00Z","modified":"2025-03-27T14:04:06.184Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:32.156873Z"}],"euvd":[{"id":"EUVD-2022-49408","description":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.","status":"published","published":"2023-02-02T00:00:00Z","modified":"2025-03-27T14:04:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:49.948923Z"}],"ghsa":[{"id":"GHSA-q3q6-m34m-pq3r","title":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file...","description":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.","status":"published","published":"2023-02-02T15:30:45Z","modified":"2025-03-27T15:31:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:00:29.248113Z"}],"nvd":[{"id":"CVE-2022-46604","description":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.","status":"published","published":"2023-02-02T13:15:09.557Z","modified":"2026-06-17T05:12:04.16Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:07:36.026349Z"}],"osv":[{"id":"CVE-2022-46604","description":"An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.","status":"published","published":"2023-02-02T00:00:00Z","modified":"2026-10-28T02:30:54.633715753Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.481647Z"}]}}