CVE-2018-15535: Responsive FileManager ajax_calls.php path traversal allows file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable file read with public exploit code and very high EPSS, though limited to confidentiality impact.

What it is

tecrail Responsive FileManager before 9.13.4 builds a pathname from external input in /filemanager/ajax_calls.php without neutralizing ".." sequences, so the resolved path can escape the intended restricted directory. This is a classic directory traversal (CWE-22) that exposes files outside the file manager's root.

Impact

An unauthenticated remote attacker can read files outside the restricted directory, giving access to configuration, credential or source files reachable by the web server process. The CVSS vector shows high confidentiality impact only, with no integrity or availability effect.

Attack surface

Reached over the network via HTTP requests to /filemanager/ajax_calls.php with crafted get_file path parameters; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Public exploit code exists (Exploit-DB 45271 and a Full Disclosure post), and EPSS is 0.45242 (98.7th percentile), indicating high predicted exploitation activity; the CVE is not listed in CISA KEV.

What to do

• Upgrade tecrail Responsive FileManager to 9.13.4 or later, which fixes the traversal.
• If upgrade is not possible, restrict or block access to /filemanager/ajax_calls.php and the filemanager directory from untrusted networks.
• Run the web service with least privilege and confine its filesystem access so traversal cannot reach sensitive paths.
• Validate and canonicalize any user-supplied path against the allowed base directory before file operations.

Detection

• Monitor web logs for requests to /filemanager/ajax_calls.php containing ".." or encoded traversal sequences in parameters.
• Alert on file reads returning content from paths outside the file manager root, especially configuration or credential files.
• Search for known exploit payload patterns from Exploit-DB 45271 in HTTP request bodies and query strings.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.