CVE-2026-108801
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-284, CWE-434
Impact
Authenticated remote attackers can upload arbitrary files to write unauthorized content or execute code on the server. They need valid user credentials for the TinyFileManager instance to perform the upload.
Root cause
The move_uploaded_file implementation in tinyfilemanager.php fails to restrict or validate the fullpath parameter, allowing unrestricted file uploads.
Affected systems
prasathmani TinyFileManager up to 2.6
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patched version is listed. Restrict access to the TinyFileManager web interface via network allowlists, disable the upload functionality, or take the application offline until patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.