CVE-2022-45476: Malicious File Upload

Published Nov 25, 2022

Updated

Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible because the application is vulnerable to insecure file upload.

Affected Software

2 affected components

Tiny File Manager Project Tiny File Manager=2.4.8

prasathmani Tiny File Manager=2.4.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tiny File Manager to a version that resolves this vulnerability.
Fixed in 2.4.8

Event History

Nov 25, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2022-45476?

CVE-2022-45476 is a vulnerability in Tiny File Manager version 2.4.8 that allows users to execute code uploaded to the application instead of just downloading it.

How severe is CVE-2022-45476?

CVE-2022-45476 has a severity rating of 9.8, which is considered critical.

What is the affected software version for CVE-2022-45476?

CVE-2022-45476 affects Tiny File Manager version 2.4.8.

How can the code execution vulnerability be exploited in Tiny File Manager?

The code execution vulnerability in Tiny File Manager version 2.4.8 can be exploited by uploading files that contain malicious code.

Are there any references related to CVE-2022-45476?

Yes, you can find more information about CVE-2022-45476 at the following references: [Fluid Attacks Advisory](https://fluidattacks.com/advisories/mosey/) and [GitHub Repository](https://github.com/prasathmani/tinyfilemanager/).