This vulnerability affects prasathmani TinyFileManager up to version 2.6 in the file upload handler component. Specifically, the argument 'uploadurl' in the /filemanager.php endpoint can be manipulated to perform server-side request forgery (SSRF). This allows an attacker to make the server send unauthorized requests to internal or external systems. The vulnerability is remotely exploitable and has been publicly disclosed. No official vendor response or patch is available at this time.

Successful exploitation of this SSRF vulnerability could allow an attacker to make the vulnerable server perform unauthorized requests to internal or external resources. This may lead to information disclosure or interaction with internal services that are not otherwise accessible. The CVSS score of 5.3 reflects a medium impact, with low privileges required and no user interaction needed. There are no known exploits in the wild as of the published date.

No official patch or remediation is currently available from the vendor, as they have not responded to disclosure attempts. Users should monitor the vendor's communications for any future updates or patches. Until a fix is released, consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests, if feasible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.