Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-108801: TinyFileManager allows remote file upload
CVE-2026-108801 · published 6 days ago
Summary
The TinyFileManager web tool can be tricked into accepting files from an attacker and saving them on the server. This lets a malicious user place harmful files on the system, potentially leading to further compromise. Upgrade to a newer version or apply the vendor’s fix and restrict upload permissions.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| prasathmani | tinyfilemanager | 2.0 |
Original advisory text
prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload
A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
References
- https://vuldb.com/cve/CVE-2026-108801 third-party-advisory
- https://vuldb.com/vuln/416578 vdb-entry technical-description
- https://vuldb.com/vuln/416578/cti signature permissions-required
- https://vuldb.com/submit/962457 third-party-advisory
- https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d exploit
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-284Improper Access Control
CWE-434Unrestricted File Upload
Timeline
Published12 Oct 2026
Updated15 Oct 2026
First seen12 Oct 2026
Track software like this
Free during beta