CVE-2026-116044

prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The flaw is an unrestricted file upload in the tinyfilemanager.php Remote URL File Upload Module, allowing an attacker to upload any file type, including executable scripts. Based on the description, it is inferred that this could enable the execution of arbitrary code on the server, a classic remote code execution scenario. The vulnerability is classified as an access control failure (CWE-284) and an unrestricted upload flaw (CWE-434).

Affected Systems

The issue affects the prasathmani TinyFileManager product, specifically all releases up to and including version 2.6.

Risk and Exploitability

The CVSS score is 5.3, indicating moderate severity, and the EPSS score is not available, leaving the exact exploitation likelihood uncertain. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers can initiate the exploit remotely via the web interface, uploading malicious files that may be executed by the server if permission and configuration allow. No specific prerequisites beyond the presence of the vulnerable upload feature are mentioned.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check for and apply any available vendor patch or newer release of TinyFileManager that addresses the unrestricted upload flaw.
  • If no patch is available, disable the Remote URL File Upload module entirely or limit its use to authenticated, trusted users only.
  • Configure the web server so that the upload directory is treated as non‑executable and drop right‑click file execution permissions, and enforce MIME restrictions to reject execution of uploaded files.

Generated by OpenCVE AI on October 25, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload
First Time appeared Prasathmani
Prasathmani tinyfilemanager
Weaknesses CWE-284
CWE-434
CPEs cpe:2.3:a:prasathmani:tinyfilemanager:*:*:*:*:*:*:*:*
Vendors & Products Prasathmani
Prasathmani tinyfilemanager
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 7:46 PM
Reserved
Oct 24, 2026, 1:46 PM

View source JSON

Updated
Oct 29, 2026, 7:45 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 6:16 AM
Modified
Oct 29, 2026, 8:17 PM

View source JSON

No data.

Updated
Oct 25, 2026, 10:15 AM

JSON