Security readout for executives and security teams
Plain-English summary
Responsive Filemanager through 9.14.0 has a stored cross-site scripting weakness. A value saved in a session variable was not sanitized consistently, so attacker-controlled content could later be rendered when the file manager dialog page is opened.
Executive priority
Treat this as a moderate web application risk. Prioritize systems where the file manager is internet-facing, used by many authenticated users, or embedded in administrative workflows handling sensitive content.
Technical view
The issue involves $_SESSION['RF']['view_type']. ajax_calls.php could set this value through the view action without sanitization, and dialog.php reused it without sanitizing if already set. This creates stored XSS in affected Responsive Filemanager deployments through 9.14.0.
Likely exposure
Exposure is most likely where Responsive Filemanager through 9.14.0 is embedded in a web application and its file manager endpoints are reachable by untrusted or lower-privileged users.
Exploitation context
The source bundle does not show CISA KEV listing, active exploitation, CVSS scoring, or a named fixed release. The public issue describes the vulnerable data flow but should not be treated as proof of exploitation in the wild.
Researcher notes
Evidence is limited to the CVE record and the linked GitHub issue. The root cause is inconsistent sanitization of a session-backed view setting across ajax_calls.php and dialog.php. No CVSS, CWE, exploit-in-the-wild, or vendor fix details are provided in the bundle.
Mitigation direction
- Inventory applications embedding Responsive Filemanager and identify versions through 9.14.0.
- Check upstream project guidance for a fixed release or official patch.
- Restrict file manager endpoints to trusted authenticated users only.
- If maintaining a fork, sanitize and encode view_type before storage and rendering.
- Clear existing sessions after remediation to remove persisted unsafe values.
Validation and detection
- Confirm whether Responsive Filemanager through 9.14.0 is present in deployed applications.
- Check whether ajax_calls.php and dialog.php are reachable in production.
- Review code for sanitization of $_SESSION['RF']['view_type'] before rendering.
- Verify file manager access is limited to appropriate administrative roles.
- Review application security tests for stored XSS coverage around file manager views.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-11106 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/trippo/ResponsiveFilemanager/issues/603CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.