Path Traversal in TinyFileManager /filemanager.php POST Parameter

Publication date: 2026-04-17

Last updated on: 2026-04-29

Assigner: VulDB

Description

A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the component POST Parameter Handler. The manipulation of the argument file[] results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-17

Last Modified

2026-04-29

Generated

2026-07-06

AI Q&A

2026-04-17

EPSS Evaluated

2026-07-05

NVD

CVE-2026-6496

EUVD

EUVD-2026-23437

Affected Vendors & Products

Vendor	Product	Version / Range
prasathmani	tinyfilemanager	to 2.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in prasathmani TinyFileManager up to version 2.6, specifically in the file /filemanager.php within the POST Parameter Handler component. It involves manipulation of the 'file[]' argument, which leads to a path traversal issue. This means an attacker can craft requests to access files and directories outside the intended scope by exploiting the way the application handles the 'file[]' parameter. The attack can be performed remotely.

Impact Analysis

The path traversal vulnerability allows an attacker to access files and directories that should be restricted. This can lead to unauthorized information disclosure, potentially exposing sensitive files on the server. Additionally, the vulnerability may allow limited integrity and availability impacts, meaning an attacker could alter or disrupt files or services to some extent.

Hi! I’m here to help you understand CVE-2026-6496. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70