CVE-2026-108801: prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload
A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function moveuploadedfile of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs remote network access and low-privilege access to the affected TinyFileManager instance. No user interaction is required.
Which releases are affected?
TinyFileManager versions up to 2.6 are reported as affected. The provided information does not identify a fixed version.
Is exploitation practical?
The exploit has been publicly released and may be used in attacks. The reported attack complexity is low.
What is the impact of a successful exploit?
The flaw allows unrestricted file upload through manipulation of the fullpath argument passed to move_uploaded_file in tinyfilemanager.php. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.
Is a vendor fix or response available?
The vendor was contacted early in the disclosure process but reportedly did not respond. The provided information does not describe a patch or workaround.