The vulnerability lies in the file manager.php endpoint of TinyFileManager 2.6 and earlier. An attacker can manipulate the uploadurl parameter in the File Upload Handler. This allows the server to issue HTTP requests to arbitrary URLs, enabling server‑side request forgery. The flaw can be triggered remotely, and the exploit is already publicly disclosed. By abusing the vulnerability an attacker may cause the application to communicate with internal systems, leak sensitive data, or perform unintended actions on third‑party services.

Prasathmani TinyFileManager up to version 2.6 is affected. The flaw exists within the File Upload feature accessed via /filemanager.php?p=ajax=true&type=upload. No specific sub‑versions are listed beyond the known maximum of 2.6, and the vendor has not released a fix for this release cycle.

The CVSS score is 5.3, indicating a moderate severity. No EPSS data is available, and the vulnerability is not in CISA KEV. The attack vector is remote web‑based access to the affected endpoint; the exploitation does not require authentication, but the attacker needs to be able to send a crafted request to the server. Because the flaw is publicly disclosed and the server performs outbound requests, the risk to exposed services is tangible and should be addressed without delay.