CVE-2018-14728: Responsive FileManager upload.php SSRF via url parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no privileges or interaction required, public exploit references and a very high EPSS score make this an urgent fix despite the absence of KEV listing.

What it is

Responsive FileManager 9.13.1 exposes an SSRF flaw in upload.php through the url parameter, allowing the server to fetch attacker-controlled URLs. The record gives no detail on what the fetched response is used for, so the practical consequence beyond server-side request forgery is not stated. With a CVSS 3.0 score of 9.8 and public exploit references, it warrants prompt attention wherever this component is deployed.

Impact

An attacker can make the affected server issue requests to arbitrary URLs, which can reach internal services or cloud metadata endpoints that are not otherwise exposed. The record does not state whether response data is returned to the attacker, so data exfiltration cannot be confirmed from the supplied facts.

Attack surface

Reached over the network through upload.php with the url parameter; the CVSS vector shows no privileges required and no user interaction. No authentication requirement is documented in the record.

Exploitation

Public exploit code is referenced on Packet Storm and Exploit-DB, and EPSS is 0.76511 (99.5th percentile), indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, so confirmed in-the-wild use is not established by this record.

What to do

• Upgrade Responsive FileManager past 9.13.1 to a version where the SSRF is fixed, or remove the component if it is unused.
• Restrict outbound network access from the web server so it cannot reach internal addresses, link-local ranges or cloud metadata endpoints.
• Validate and allowlist the url parameter in upload.php, rejecting internal, loopback and non-HTTP schemes.
• Place the file manager behind authentication and network controls if it must remain reachable.

Detection

• Review web server and proxy logs for requests to upload.php with a url parameter pointing at internal, loopback or metadata addresses.
• Monitor outbound connections from the web server to unexpected hosts or ports, especially 169.254.169.254 and RFC1918 ranges.
• Alert on repeated or anomalous upload.php requests from single sources, which may indicate scanning or exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.