CVE-2026-6382critical

CVE-2026-6382: falha crítica em FileOrganizer

Multiple elFinder Plugins - Authenticated OS Command Injection

Publicada em

Seguir esta CVE+ Monitorar File Manager+ Monitorar File Manager Pro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.1epss 1.4%
The FileOrganizer WordPress plugin before 1.1.9, Advanced File Manager WordPress plugin before 5.4.12, File Manager Pro WordPress plugin before 2.1.1, File Manager WordPress plugin before 8.0.4 do not properly escape a parameter before passing it to a shell command when processing image operations, allowing authenticated users to perform OS Command Injection. This requires the server to have the ImageMagick convert CLI available without either the PHP imagick or GD extensions.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Unknown · Advanced File ManagerUnknown · File ManagerUnknown · File Manager ProUnknown · FileOrganizer
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — FileOrganizer

No mesmo produto, das mais perigosas para as menos.

CVE-2023-4827HIGHFile Manager Pro < 1.8 - Remote Code Execution via CSRFEPSS 7.9%CVE-2026-17540HIGHBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchEPSS 1.8%CVE-2023-4861HIGHFile Manager Pro < 1.8.1 - Admin+ Remote Code ExecutionEPSS 1.7%CVE-2026-11565HIGHAdvanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_uiEPSS 1.3%CVE-2021-24177—WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2023-5907MEDIUMFile Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalEPSS 0.9%