CVE-2026-37637: Alexantr FileManager RCE Vulnerability

CVE-2026-37637 Overview

CVE-2026-37637 is a code injection vulnerability in Alexantr filemanager version 1.0. The flaw resides in the filemanager.php component and allows a remote, unauthenticated attacker to execute arbitrary code on the host running the application. The issue is classified under [CWE-94] Improper Control of Generation of Code. A public proof-of-concept exists in a GitHub PoC Repository, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code through filemanager.php, leading to full compromise of the hosting web server.

Affected Products

Alexantr filemanager version 1.0
Deployments exposing filemanager.php to untrusted networks
Web applications embedding the Alexantr filemanager component

Discovery Timeline

2026-06-29 - CVE-2026-37637 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-37637

Vulnerability Analysis

CVE-2026-37637 is a remote code execution flaw affecting the filemanager.php component of Alexantr filemanager v1.0. The vulnerability falls under [CWE-94] Improper Control of Generation of Code, meaning attacker-controlled input reaches a code interpretation sink within the PHP application. Successful exploitation grants the attacker the ability to run arbitrary PHP code under the privileges of the web server process.

Because the attack is network-based and requires no authentication or user interaction, any internet-exposed instance is reachable by opportunistic scanners. The EPSS model estimates a 0.471% probability of exploitation in the next 30 days, placing this CVE in the 37th percentile of exploit likelihood.

Root Cause

The root cause is unsafe handling of user-supplied input within filemanager.php. Input is passed to a construct that generates or evaluates PHP code without adequate validation, sanitization, or type enforcement. This allows crafted request parameters to alter application control flow and inject executable code paths.

Attack Vector

Exploitation occurs over the network by sending a crafted HTTP request to filemanager.php on a vulnerable host. The attacker manipulates request parameters processed by the file manager to trigger the code generation sink. No credentials are required, and no user interaction is needed. Technical exploitation details are available in the public GitHub PoC Repository.

Detection Methods for CVE-2026-37637

Indicators of Compromise

Unexpected HTTP POST or GET requests to filemanager.php containing PHP syntax, function names, or base64-encoded payloads
New or modified PHP files in the file manager's working directory outside normal administrative activity
Web server processes spawning shells (/bin/sh, bash, cmd.exe) or outbound connections to unknown hosts
Presence of webshell artifacts such as files invoking eval, system, passthru, or assert

Detection Strategies

Inspect web server access logs for anomalous parameter values targeting filemanager.php
Deploy web application firewall (WAF) signatures that flag PHP code patterns in request parameters
Correlate HTTP requests to filemanager.php with subsequent child process creation on the web host
File integrity monitoring on the filemanager installation directory to detect unauthorized modifications

Monitoring Recommendations

Enable verbose logging on the web server and centralize logs for retention and analysis
Alert on any process execution originating from the PHP-FPM or Apache worker context
Monitor egress traffic from web servers for connections to non-approved destinations
Baseline normal usage of the file manager and alert on deviations in request volume or parameter shape

How to Mitigate CVE-2026-37637

Immediate Actions Required

Remove or restrict network access to filemanager.php until a fix is applied
Place the application behind authentication and a WAF configured to block PHP code in request parameters
Audit the host for signs of prior exploitation, including new files, cron jobs, and outbound connections
Rotate any credentials or secrets stored on or accessible from the affected server

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-37637 at the time of publication. Operators should track the upstream Alexantr filemanager project for a fixed release and, until one is available, treat the component as untrusted. Consult the GitHub PoC Repository for technical context that may inform interim controls.

Workarounds

Disable or remove filemanager.php from production deployments where it is not strictly required
Enforce authentication and IP allow-listing on the file manager endpoint via the reverse proxy or web server configuration
Run the PHP process under a least-privileged account with restricted filesystem write permissions
Disable dangerous PHP functions such as eval, exec, system, passthru, and assert via disable_functions in php.ini

bash

# Example: restrict access to filemanager.php in nginx
location = /filemanager.php {
    allow 10.0.0.0/8;
    deny all;
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}

# Example: disable risky PHP functions in php.ini
disable_functions = eval,exec,system,passthru,shell_exec,assert,proc_open,popen