This vulnerability in prasathmani TinyFileManager up to version 2.6 allows remote attackers to perform server-side request forgery by manipulating the uploadurl parameter in the file /filemanager.php?p= with ajax=true&type=upload. The flaw resides in the File Upload Handler component, enabling attackers to cause the server to make unintended requests. The vendor was notified but has not issued any fix or advisory. There is no official remediation available at this time.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the server send arbitrary requests to internal or external systems, potentially leading to information disclosure or interaction with internal services. However, the CVSS score and description indicate limited impact with low to medium confidentiality, integrity, and availability effects. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests, such as firewall rules or proxy filtering. Monitoring and restricting access to the vulnerable endpoint may also reduce risk until an official fix is available.