CVE-2018-15535

HIGH NUCLEI

tecrail Responsive FileManager < 9.13.4 - Path Traversal via get_file Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-15535. PoCs published by Simon Uvarov. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability (CVE-2018-15536) in Responsive FileManager, allowing arbitrary file read and directory traversal during archive extraction. The PoC includes a base64-encoded ZIP file to exploit the ZipSlip vulnerability.

Description

/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Simon Uvarov · textwebappsphp

https://www.exploit-db.com/exploits/45271

View Code ZIP pw:eip

This exploit demonstrates a path traversal vulnerability (CVE-2018-15536) in Responsive FileManager, allowing arbitrary file read and directory traversal during archive extraction. The PoC includes a base64-encoded ZIP file to exploit the ZipSlip vulnerability.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Responsive FileManager < 9.13.4

Auth required

Prerequisites: Access to the target application · Valid session cookie

MITRE ATT&CK

T1006 - Direct Volume Access T1190 - Exploit Public-Facing Application

devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

Responsive FileManager <9.13.4 - Local File Inclusion

HIGHby daffainfo

References (2)

Core 2

Core References

Exploit, Third Party Advisory, VDB Entry exploit x_refsource_exploit-db

https://www.exploit-db.com/exploits/45271/

Exploit, Mailing List, Third Party Advisory mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2018/Aug/34

Scores

CVSS v3 7.5

EPSS 0.4524

EPSS Percentile 98.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-22

Status published

Products (1)

tecrail/responsive_filemanager < 9.13.4

Published Aug 24, 2018

Tracked Since Feb 18, 2026