This vulnerability in Trippo ResponsiveFilemanager versions 9.0 through 9.14.0 allows an attacker to perform unrestricted file uploads through an unspecified function in the filemanager/dialog.php component. The flaw can be exploited remotely without any privileges or user interaction, potentially enabling attackers to upload malicious files. The vendor was notified but did not respond, and the product is no longer maintained. Exploit code has been publicly released, increasing the risk of exploitation.

Successful exploitation allows remote attackers to upload arbitrary files without restrictions, which could lead to unauthorized code execution or other malicious activities depending on the server configuration and file handling. The vulnerability is rated medium severity with a CVSS 4.0 score of 6.9, reflecting network attack vector, no required privileges, and low to limited impact on confidentiality, integrity, and availability.

No official patch or remediation is available as the affected versions are no longer supported by the vendor. Users are advised to discontinue use of the affected versions and migrate to alternative solutions or updated file management software that is actively maintained. Implementing additional access controls or disabling the vulnerable component may reduce risk but no vendor-provided fix exists.