Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-10567: Responsive Filemanager JPEG Image Upload Security Risk
CVE-2020-10567 · published 6 years ago
Summary
A security risk exists in Responsive Filemanager due to the lack of validation on image file extensions. This could allow attackers to upload malicious JPEG images that contain hidden code. To protect your system, consider disabling the 'save_img' action in the configuration file.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| tecrail | responsive_filemanager |
<= 9.14.0 cpe:2.3:a:tecrail:responsive_filemanager:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. ...
An issue was discovered in Responsive Filemanager through 9.14.0. In the ajax_calls.php file in the save_img action in the name parameter, there is no validation of what kind of extension is sent. This makes it possible to execute PHP code if a legitimate JPEG image contains this code in the EXIF data, and the .php extension is used in the name parameter. (A potential fast patch is to disable the save_img action in the config file.)
References
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-20Improper Input Validation
Timeline
Published14 Mar 2020
Updated29 Sep 2026
First seen7 Aug 2026
Track software like this
Free during beta