CVE-2019-16790

2019-12-3020:15:12

Google

osv.dev

7.7 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.2%

JSON

In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.

CPENameOperatorVersion
tinyfilemanagereq2.0.2
tinyfilemanagereq2.0.1
tinyfilemanagereq2.3.4
tinyfilemanagereq2.3
tinyfilemanagereq2.2.0
tinyfilemanagereq2.3.8

Name	Operator	Version
tinyfilemanager	eq	2.0.2
tinyfilemanager	eq	2.0.1
tinyfilemanager	eq	2.3.4
tinyfilemanager	eq	2.3
tinyfilemanager	eq	2.2.0
tinyfilemanager	eq	2.3.8

References

github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8

github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr