Threat database

CVE-2026-108801 is a medium severity vulnerability in prasathmani TinyFileManager up to version 2.6. It involves an unrestricted file upload flaw in the move_uploaded_file function within tinyfilemanager.php. This vulnerability allows remote attackers to upload files without proper restrictions. The exploit code has been publicly released. The vendor was contacted but did not respond or provide a fix.

CVE-2026-6497 is a server-side request forgery (SSRF) vulnerability in prasathmani TinyFileManager versions up to 2.6. The vulnerability exists in the file /filemanager.php? p= with the ajax=true&type=upload parameters, specifically in the File Upload Handler component. Manipulating the uploadurl argument allows an attacker to initiate SSRF remotely. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a patch. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

CVE-2026-6496 is a path traversal vulnerability in prasathmani TinyFileManager versions up to 2.6. The issue exists in the POST parameter handler of the /filemanager.php file, where manipulation of the 'file[]' argument allows an attacker to perform path traversal remotely. The vulnerability has a medium severity with a CVSS score of 5.3. The vendor has not responded to disclosure attempts and no official patch or remediation is currently available. Exploit details have been made public, but no known exploits in the wild have been reported.

A flaw has been found in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php. This manipulation of the argument fullpath causes path traversal. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.