CVE-2026-85081highCWE-79

CVE-2026-85081: fallo de gravedad alta en File Manager

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

Publicada el

Seguir esta CVE+ Monitorear File Manager+ Monitorear File Manager Pro

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

41Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 7.5epss 0.2%
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Unknown · File ManagerUnknown · File Manager ProUnknown · FileOrganizer
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — File Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-4827HIGHFile Manager Pro < 1.8 - Remote Code Execution via CSRFEPSS 7.9%CVE-2026-17540HIGHBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchEPSS 1.8%CVE-2023-4861HIGHFile Manager Pro < 1.8.1 - Admin+ Remote Code ExecutionEPSS 1.7%CVE-2026-6382CRITICALMultiple elFinder Plugins - Authenticated OS Command InjectionEPSS 1.4%CVE-2021-24177—WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2023-5907MEDIUMFile Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalEPSS 0.9%