CVE-2026-6382

Name of the Vulnerable Software and Affected Versions FileOrganizer versions prior to 1.1.9 Advanced File Manager versions prior to 5.4.12 File Manager Pro versions prior to 2.1.1 File Manager versions prior to 8.0.4

Description Authenticated users can perform OS Command Injection when the software processes image operations. This occurs because a parameter is not properly escaped before being passed to a shell command. This issue is exploitable if the server has the ImageMagick convert CLI available and lacks both the PHP imagick and GD extensions.

Recommendations Update FileOrganizer to version 1.1.9 or later. Update Advanced File Manager to version 5.4.12 or later. Update File Manager Pro to version 2.1.1 or later. Update File Manager to version 8.0.4 or later.