CVE-2026-108801

MEDIUM 6.3

prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-434 CWE-284
Vendor	prasathmani
Product	tinyfilemanager
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for prasathmani tinyfilemanager

Be the first to know when new medium vulnerabilities affecting prasathmani tinyfilemanager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

prasathmani / TinyFileManager

2.0 2.1 2.2 2.3 2.4 2.5 2.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/416578 vuldb.com: https://vuldb.com/vuln/416578/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108801 vuldb.com: https://vuldb.com/submit/962457 gist.github.com: https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d

Credits

🔍 silverdragon (VulDB User) VulDB CNA Team