CVE Catalog
CVE-2025-63994
CriticalSummary
An arbitrary file upload vulnerability in the /php/UploadHandler.php component of RichFilemanager v2.7.6 allows attackers to execute arbitrary code via uploading a crafted file.
Risk Assessment
Risk of remote code execution and full server compromise by an attacker.
Recommendation
Update to a patched version and implement file type validation and size restrictions.
Original NVD description (English source)
An arbitrary file upload vulnerability in the /php/UploadHandler.php component of RichFilemanager v2.7.6 allows attackers to execute arbitrary code via uploading a crafted file.