CVE-2019-16790 - Vulnerability Details - OpenCVE

In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.02173.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Tiny File Manager

Tiny File Manager

affected

Version	Status	Constraints
`before 2.3.9`	affected	—

Configuration 1 [-]

cpe:2.3:a:prasathmani:tiny_file_manager:*:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors	Products
Prasathmani Subscribe	Tiny File Manager Subscribe

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2019-7302	In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8
https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr

History

Wed, 31 Dec 2025 19:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Prasathmani Prasathmani tiny File Manager
CPEs	cpe:2.3:a:tiny_file_manager_project:tiny_file_manager::::::::	cpe:2.3:a:prasathmani:tiny_file_manager::::::::
Vendors & Products	Tiny File Manager Project Tiny File Manager Project tiny File Manager	Prasathmani Prasathmani tiny File Manager

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2019-12-30T19:15:14.000Z

Updated: 2024-08-05T01:24:48.387Z

Reserved: 2019-09-24T00:00:00.000Z

Link: CVE-2019-16790

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-12-30T20:15:12.560

Modified: 2025-12-31T19:40:50.980

Link: CVE-2019-16790

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"containers": {"cna": {"affected": [{"product": "Tiny File Manager", "vendor": "Tiny File Manager", "versions": [{"status": "affected", "version": "before 2.3.9"}]}], "descriptions": [{"lang": "en", "value": "In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-12-30T19:15:14.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8"}], "source": {"advisory": "GHSA-w72h-v37j-rrwr", "discovery": "UNKNOWN"}, "title": "Remote Code Execution in Tiny File Manager", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2019-16790", "STATE": "PUBLIC", "TITLE": "Remote Code Execution in Tiny File Manager"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Tiny File Manager", "version": {"version_data": [{"version_value": "before 2.3.9"}]}}]}, "vendor_name": "Tiny File Manager"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr", "refsource": "CONFIRM", "url": "https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr"}, {"name": "https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8", "refsource": "MISC", "url": "https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8"}]}, "source": {"advisory": "GHSA-w72h-v37j-rrwr", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T01:24:48.387Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2019-16790", "datePublished": "2019-12-30T19:15:14.000Z", "dateReserved": "2019-09-24T00:00:00.000Z", "dateUpdated": "2024-08-05T01:24:48.387Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:prasathmani:tiny_file_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC377DEA-48B3-40F4-8CD4-1BF28A2E03F5", "versionEndExcluding": "2.3.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Tiny File Manager before 2.3.9, there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted."}, {"lang": "es", "value": "En Tiny File Manager versiones anteriores a la versi\u00f3n 2.3.9, Hay una ejecuci\u00f3n de c\u00f3digo remota por medio Upload desde URL y Edit/Rename files. Solo los usuarios autenticados est\u00e1n afectados."}], "id": "CVE-2019-16790", "lastModified": "2025-12-31T19:40:50.980", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-12-30T20:15:12.560", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/prasathmani/tinyfilemanager/commit/9a499734c5084e3c2eb505f100d50baac1793bd8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/prasathmani/tinyfilemanager/security/advisories/GHSA-w72h-v37j-rrwr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-434"}], "source": "nvd@nist.gov", "type": "Primary"}]}