CVE-2026-5482 is a critical vulnerability in Tecrail's Responsive FileManager that permits unauthenticated attackers to upload files with dangerous types and extensions through the dialog.php endpoint. This unrestricted file upload (CWE-434) can result in remote code execution on the affected system. The vulnerability affects all versions up to and including 9.14.0. The project is unmaintained, and no remediation level or patch has been provided by the vendor as of the CVE publication date.

An attacker can upload arbitrary files without authentication, potentially leading to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The CVSS 4.0 base score of 9.3 reflects the critical severity and ease of exploitation without any privileges or user interaction.

No official fix or patch is available due to the project being unmaintained. Users should consider discontinuing use of Responsive FileManager or deploying compensating controls such as disabling file uploads, restricting access to the dialog.php endpoint, or isolating the application in a secure environment. Monitoring for suspicious activity and applying web application firewalls with strict upload filtering may help reduce risk until a secure alternative is adopted.