CVE-2021-40964: CSRF
A Path Traversal vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload a file (with Admin credentials or with the CSRF vulnerability) with the "fullpath" parameter containing path traversal strings (../ and ..\) in order to escape the server's intended working directory and write malicious files onto any directory on the computer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TinyFileManagerto a version that resolves this vulnerability.Fixed in 2.4.6 - Configuration
Update TinyFileManager so the upload handler validates the 'fullpath' parameter and rejects traversal sequences ('../' and '..\\') to prevent escaping the server’s intended working directory.
TinyFileManager fullpath parameter = Reject/disable inputs containing path traversal strings (../ and ..\)
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40964?
CVE-2021-40964 has a high severity rating due to its potential for remote code execution through unauthorized file uploads.
How do I fix CVE-2021-40964?
To fix CVE-2021-40964, upgrade TinyFileManager to version 2.4.7 or later, which addresses the path traversal vulnerability.
What systems are affected by CVE-2021-40964?
CVE-2021-40964 affects all versions of TinyFileManager up to and including version 2.4.6.
What is a path traversal vulnerability as seen in CVE-2021-40964?
A path traversal vulnerability allows attackers to manipulate file paths to access unauthorized files on the server.
Can attackers exploit CVE-2021-40964 without credentials?
Yes, attackers can exploit CVE-2021-40964 using CSRF vulnerabilities to upload files without valid credentials.