| Titel | prasathmani TinyFileManager <=2.6 Unrestricted Upload |
|---|
| Beschreibung | A vulnerability has been identified in the remote URL file upload module that allows an authenticated user with file upload privileges to upload files with a disallowed extension (e.g. .php), bypassing the configured whitelist defined by FM_UPLOAD_EXTENSION.
The issue is caused by the order of operations: extension validation is performed on the "dirty" filename (including the query string), while the file is saved using the "clean" filename (after removing the query string). |
|---|
| Quelle | ⚠️ https://drive.google.com/file/d/1db5JeUDltknuzWMaFQB0cYYDVpmFWpl7/view |
|---|
| Benutzer | argh (UID 101260) |
|---|
| Einreichung | 22.09.2026 01:47 (vor 1 Monat) |
|---|
| Moderieren | 24.10.2026 15:46 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 426120 [prasathmani TinyFileManager bis 2.6 Remote URL File Upload tinyfilemanager.php erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|