CVE-2026-108801
Received Received - Intake

Unrestricted File Upload in TinyFileManager

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108801
EUVD
EUVD-2026-97176

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
prasathmani TinyFileManager 2.0
prasathmani TinyFileManager 2.1
prasathmani TinyFileManager 2.2
prasathmani TinyFileManager 2.3
prasathmani TinyFileManager 2.4
prasathmani TinyFileManager 2.5
prasathmani TinyFileManager 2.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unrestricted file upload flaw in prasathmani TinyFileManager versions up to 2.6. It exists in the move_uploaded_file function of tinyfilemanager.php where manipulating the fullpath argument allows attackers to bypass restrictions and upload malicious files remotely.

Impact Analysis

An attacker could exploit this to upload malicious files to your server, potentially leading to remote code execution, data theft, or further compromise of your system. Since the exploit is public, the risk of attacks is higher.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or reputational damage.

Mitigation Strategies

Immediately update TinyFileManager to the latest version beyond 2.6 if available. If no update exists, disable file upload functionality or restrict access to the tinyfilemanager.php file. Monitor network traffic for unusual file uploads or suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108801. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart