CVE-2026-108801: Unrestricted Upload in prasathmani TinyFileManager

This vulnerability affects prasathmani TinyFileManager up to version 2.6. The issue lies in the move_uploaded_file function of tinyfilemanager.php, where manipulation of the 'fullpath' argument enables unrestricted file uploads. This flaw allows remote attackers to upload arbitrary files to the server, potentially leading to further compromise. The exploit code is publicly available, increasing the risk of exploitation. The vendor has not issued a response or patch as of the publication date.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system without restriction. This can lead to unauthorized file placement, potentially enabling code execution or other malicious activities depending on the server configuration and file handling. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider restricting access to the affected application, applying web application firewall rules to block suspicious upload attempts, or disabling the vulnerable functionality until a fix is released.