CVE-2022-46604

Deeper analysis

CVE-2022-46604 is an unrestricted file upload vulnerability (CWE-434) affecting Tecrail Responsive FileManager versions 9.9.5 and earlier. The flaw resides in the file extension validation logic within the upload handling code, allowing an authenticated user to bypass checks and upload a crafted PHP file that can subsequently be executed on the server.

An attacker with low-privileged authenticated access can exploit the issue over the network without user interaction to achieve remote code execution, resulting in full compromise of confidentiality, integrity, and availability on the affected host. Public exploit code and a detailed write-up demonstrating the bypass have been published, confirming the attack path involves manipulating the upload request to execute arbitrary PHP payloads.

The vendor addressed the issue in version 9.9.6, as noted in the project changelog, by updating the relevant validation routines in execute.php. Security practitioners should upgrade promptly and review any custom configurations that expose the file manager to authenticated users.

EPSS for this CVE rose from lower values to a peak of 0.5769 before receding to the current 0.3658, indicating a period of increased exploitation interest following disclosure.