CVE Intelligence
Analysis AI-assisted

CVE-2026-37637: Alexantr filemanager - code injection via filemanager.php

CVE-2026-37637 is a code injection weakness (CWE-94) reported in Alexantr filemanager v1.0 through its filemanager.php component, which the record says allows a remote attacker to execute arbitrary code. The CVSS 3.1 score in the record is 9.1 (Critical), but no affected-version or fixed-version data is provided. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-37637 is a code injection issue (CWE-94) reported in Alexantr filemanager version 1.0, affecting the filemanager.php component. According to the CVE record, a remote attacker can execute arbitrary code. The record is listed as Deferred in its source status and was published on 2026-06-29.

Impact

  • The CVSS 3.1 vector in the record indicates network access, low complexity, no privileges and no user interaction required.
  • Confidentiality and integrity impacts are rated high; availability impact is rated none.
  • Successful code execution would let an attacker run code in the context of the web application hosting the component, which is an inference from the vulnerability class.

Affected products and versions

  • The record identifies Alexantr filemanager v1.0 as affected.
  • The affected and fixed version lists in the record are empty, so the full scope beyond v1.0 is unknown.

Exploitation status

  • The CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is about 0.66 percent, at roughly the 50th percentile. EPSS estimates likelihood of exploitation and is not evidence that exploitation has occurred.

Remediation and mitigation

  • No fixed version is listed in the record. This does not mean no fix exists; verify the current status with the project maintainers and the referenced repository.
  • If the product is in use, restrict access to the file manager to trusted administrators, remove it from internet-facing deployments when it is not needed, and place it behind authentication or network controls.
  • Review how the file manager handles uploads and file operations, and make sure the web server does not execute uploaded content.
  • If no fix is available, consider replacing the component with a maintained alternative.

Detection guidance

  • Inventory hosts for the Alexantr filemanager package and for the filemanager.php file.
  • Monitor web server logs for unexpected requests to filemanager.php, especially from unknown sources.
  • Watch for newly created or modified files in web-accessible directories and for web server processes starting unexpected child processes.

Limitations of the available information

  • The record contains no vendor advisory and no affected or fixed version data.
  • The description does not identify the vulnerable parameter, preconditions or configuration required.
  • The GitHub repository cited in the record was not verified as a vendor source, and its content was not analysed here.
  • The CVSS score comes from the record's provider; the NVD and CVE Record pages are listed as source pages.

Frequently asked questions

Is CVE-2026-37637 being actively exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted. Organizations should still treat it as high priority because of its critical CVSS score.

Which versions are affected?

The record identifies Alexantr filemanager v1.0. No other affected versions or fixed versions are listed, so the scope beyond v1.0 is unknown.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.