A path‑traversal flaw exists in prasathmani TinyFileManager versions up to 2.6. The vulnerability is triggered through manipulation of the POST parameter file[] in the filemanager.php handler. By sending specially crafted values containing directory traversal sequences, an attacker can cause the server to resolve paths outside the intended directory, potentially reading arbitrary files from the filesystem. The flaw is exploitable remotely, and a public exploit has been released, demonstrating the practical risk to deployed instances.

The affected component is prasathmani TinyFileManager, any installation where the filemanager.php handler is exposed, specifically versions up to 2.6. No earlier versions have been indicated or patched by the vendor.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale exploitation yet. The attack vector is likely a remote HTTP POST request to filemanager.php with a crafted file[] parameter. Successful exploitation would grant the attacker read access to files on the server, potentially exposing sensitive data or configuration files. The vulnerability does not inherently provide code execution but could be leveraged in a broader compromise if sensitive files are read or if an attacker later injects code via other channels.