This vulnerability in prasathmani TinyFileManager (up to version 2.6) allows remote attackers to perform path traversal via manipulation of the 'file[]' POST parameter in the /filemanager.php component. This can potentially allow unauthorized access to files outside the intended directory. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not provided any official fix or response, and no patch links are available. Exploit code has been publicly disclosed, though no active exploitation has been confirmed.

Successful exploitation of this vulnerability could allow an attacker with low privileges to read or access files outside the intended directory structure on the server running TinyFileManager. This could lead to unauthorized disclosure of sensitive information. However, the impact is limited by the requirement of low privileges and the absence of privilege escalation or remote code execution in the description.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official patch is available, users should consider restricting access to the affected component, applying web application firewall rules to block malicious POST requests targeting the 'file[]' parameter, or temporarily disabling the vulnerable functionality until a fix is released.