CVE-2026-108801

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function moveuploadedfile of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely...

EUVD-2026-97176

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function moveuploadedfile of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely...

CVE-2026-108801

A security flaw exists in prasathmani TinyFileManager (versions up to 2.6) within the tinyfilemanager.php file. The vulnerability resides in the move_uploaded_file function, where manipulating the fullpath argument allows for unrestricted upload of files. This flaw can be exploited remotely . Whi...

CVE-2026-108801 prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function moveuploadedfile of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely...

CVE-2026-108801: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function moveuploadedfile of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely...

CVE-2026-6496: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the component POST Parameter Handler. The manipulation of the argument file results in path traversal. The attack may be performed from remote. The exploit has been...

CVE-2026-6497: Server-Side Request Forgery (SSRF)

A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the file /filemanager.php?p= ajax=true&type=upload of the component File Upload Handler. This manipulation of the argument uploadurl causes server-side request...

CVE-2025-15138: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and...

CVE-2022-1000 Path Traversal in prasathmani/tinyfilemanager

Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7...

Cross-site Scripting (XSS) - Generic in prasathmani/tinyfilemanager

✍️ Description Crss site scripting bug exist via file upload 🕵️‍♂️ Proof of Concept 1. Upload a file and capture the request in burpsuite . 2. Now change fullpath parameter value to xss payload in burpsuite and forward the request . and see xss is executed Video poc...