CVE-2018-20526: Roxy Fileman unrestricted file upload in upload.php

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable unrestricted file upload with CVSS 9.8 and very high EPSS makes full server compromise likely if exposed.

What it is

Roxy Fileman 1.4.5 exposes upload.php without restricting the type of file that can be uploaded. An attacker can place executable or otherwise dangerous files on the server, which is a direct path to remote code execution if the upload directory is web-accessible. The flaw is rated critical (CVSS 9.8) and has a very high EPSS probability, so it warrants prompt attention.

Impact

An attacker gains the ability to write arbitrary files to the server, which can lead to remote code execution, defacement, or hosting of malicious content. Full compromise of confidentiality, integrity and availability is possible per the CVSS vector.

Attack surface

Reachable over the network through upload.php with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet-exposed Roxy Fileman instance is directly reachable.

Exploitation

Not listed in CISA KEV, but EPSS is 0.73056 (99.4th percentile) and public exploit references exist on Exploit-DB and Packet Storm, indicating mature, widely available exploitation.

What to do

• Upgrade Roxy Fileman to a version that restricts uploads, or remove/disable the product if it is no longer maintained.
• Restrict upload.php to authenticated, trusted users and enforce a strict allowlist of file extensions and MIME types.
• Store uploaded files outside the web root and serve them through a handler that never executes them.
• Add WAF or server rules to block executable extensions (php, phtml, jsp, asp) in upload requests.
• Monitor the upload directory for unexpected file creation and disable script execution there.

Detection

• Alert on POST requests to upload.php, especially from unauthenticated clients.
• Monitor the upload directory for newly written files with executable extensions or unusual MIME types.
• Review web server logs for upload.php requests followed by access to the uploaded file path.
• Watch for directory traversal patterns in upload parameters, as referenced in the public advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.