CVE-2021-40965: CSRF
A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by inducing the Administrator user to browse a URL controlled by an attacker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-40965?
CVE-2021-40965 has been assigned a medium severity rating due to the potential for unauthorized file uploads and command execution.
How do I fix CVE-2021-40965?
To fix CVE-2021-40965, upgrade TinyFileManager to version 2.4.7 or later to mitigate the CSRF vulnerability.
Who is affected by CVE-2021-40965?
CVE-2021-40965 affects all versions of TinyFileManager up to and including 2.4.6.
What type of vulnerability is CVE-2021-40965?
CVE-2021-40965 is a Cross-Site Request Forgery (CSRF) vulnerability that allows file uploads and command execution.
What can an attacker do with CVE-2021-40965?
An attacker can exploit CVE-2021-40965 to upload files and execute OS commands by tricking an Administrator into visiting a malicious URL.