Description

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T05:16:59.630Z",
  "pubdate": "2026-10-12T05:16:59.630Z",
  "executiveSummary": "A critical security vulnerability has been identified in prasathmani TinyFileManager up to version 2.6, classified as an Unrestricted File Upload flaw. This vulnerability arises from improper handling of user-supplied input within the file upload mechanism, specifically involving the fullpath argument.\nThe vulnerability allows a remote, unauthenticated or authenticated attacker (depending on configuration) to upload arbitrary files to the server's filesystem. Successful exploitation can lead to Remote Code Execution (RCE) by uploading executable scripts, such as PHP shells, into web-accessible directories.\nGiven that public exploit code is available and the vendor has remained unresponsive to disclosure attempts, the risk of exploitation is significantly elevated. The impact is severe, potentially resulting in complete server compromise, unauthorized access to sensitive data, and persistent backdoors.\nOrganizations utilizing TinyFileManager should treat this as a high-priority issue and implement immediate compensating controls to prevent unauthorized file operations.",
  "technicalDetails": "The vulnerability resides within the tinyfilemanager.php component, specifically involving the move_uploaded_file function. The root cause of this flaw is the insufficient validation and sanitization of the fullpath argument provided by the user during the file upload request.\nIn a secure implementation, the application should strictly validate file extensions, MIME types, and destination paths to prevent malicious files from being written to the server. However, in TinyFileManager up to 2.6, the application fails to enforce these restrictions, effectively allowing the fullpath parameter to influence the destination directory and filename of the uploaded resource.\nThe attack flow proceeds as follows: An attacker sends a crafted HTTP POST request to the server containing the target endpoint of the file upload utility. Within this request, the attacker manipulates the fullpath argument to specify an arbitrary destination on the server's filesystem. By bypassing directory traversal protections or simple extension filters, the attacker can upload a malicious file (e.g., a webshell) to a location accessible via the web server.\nOnce the file is successfully moved to the target directory, the attacker can execute the file by navigating to its URI in a standard web browser. Upon execution, the payload executes within the context of the web server process (e.g., www-data), granting the attacker the ability to execute system commands, access environment variables, manipulate databases, or traverse the filesystem to exfiltrate sensitive configuration files and user data.\nThe vulnerability is remotely exploitable without requiring advanced system access. Because the application logic relies on user-controlled input to determine the final destination of an uploaded file, it lacks the necessary integrity checks to prevent directory traversal or file overwrite attacks. The availability of public exploit scripts significantly lowers the barrier to entry for potential adversaries, allowing for automated scanning and exploitation of vulnerable deployments.\nPost-exploitation, the attacker maintains persistence by modifying existing system files or uploading additional modules. Since the vendor has not provided a patch to address the underlying input validation failure, the application remains inherently vulnerable to this attack vector regardless of the server-side OS or environment."
}