CVE-2018-20794: Tecrail Responsive Filemanager

High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days.

tecrail Responsive FileManager 9.13.4 allows remote attackers to write to an arbitrary image file (jpg/jpeg/png) via path traversal with the path parameter, through the save_img action in ajax_calls.php.

Affected products

• Tecrail Responsive Filemanager: version 9.13.4 only

Published 2019-02-25. Last modified 2026-06-17.