CVE-2026-6496: prasathmani TinyFileManager POST Parameter filemanager.php path traversal
A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the component POST Parameter Handler. The manipulation of the argument file[] results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6496?
CVE-2026-6496 has a medium severity rating due to its potential for path traversal attacks.
How do I fix CVE-2026-6496?
To fix CVE-2026-6496, upgrade TinyFileManager to version 2.7 or later that addresses this vulnerability.
What is affected by CVE-2026-6496?
CVE-2026-6496 affects all versions of TinyFileManager up to and including version 2.6.
What type of vulnerability is CVE-2026-6496?
CVE-2026-6496 is a path traversal vulnerability that can be exploited through manipulation of POST parameters.
What component is involved in CVE-2026-6496?
CVE-2026-6496 involves the POST Parameter Handler in the filemanager.php component of TinyFileManager.