CVE-2026-85081highCWE-79

CVE-2026-85081: falha de alta gravidade em File Manager

Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass

Publicada em

Seguir esta CVE+ Monitorar File Manager+ Monitorar File Manager Pro

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 7.5epss 0.2%
The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading string prefix of the site's own address, which allows an unauthenticated attacker to run arbitrary JavaScript in the session of a logged-in administrator who visits a page under their control. The defect is in the file-manager library all three bundle, and every version below 2.1.70 carries it. Updating the bundled library closes it.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
Unknown · File ManagerUnknown · File Manager ProUnknown · FileOrganizer
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — File Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2023-4827HIGHFile Manager Pro < 1.8 - Remote Code Execution via CSRFEPSS 7.9%CVE-2026-17540HIGHBit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source MismatchEPSS 1.8%CVE-2023-4861HIGHFile Manager Pro < 1.8.1 - Admin+ Remote Code ExecutionEPSS 1.7%CVE-2026-6382CRITICALMultiple elFinder Plugins - Authenticated OS Command InjectionEPSS 1.4%CVE-2021-24177—WP File Manager < 7.1 - Reflected Cross-Site Scripting (XSS)EPSS 0.9%CVE-2023-5907MEDIUMFile Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalEPSS 0.9%