| Titolo | prasathmani TinyFileManager <=2.6 Unrestricted Upload |
|---|
| Descrizione | A vulnerability has been identified in the remote URL file upload module that allows an authenticated user with file upload privileges to upload files with a disallowed extension (e.g. .php), bypassing the configured whitelist defined by FM_UPLOAD_EXTENSION.
The issue is caused by the order of operations: extension validation is performed on the "dirty" filename (including the query string), while the file is saved using the "clean" filename (after removing the query string). |
|---|
| Fonte | ⚠️ https://drive.google.com/file/d/1db5JeUDltknuzWMaFQB0cYYDVpmFWpl7/view |
|---|
| Utente | argh (UID 101260) |
|---|
| Sottomissione | 22/09/2026 01:47 (1 mese fa) |
|---|
| Moderazione | 24/10/2026 15:46 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 426120 [prasathmani TinyFileManager fino a 2.6 Remote URL File Upload tinyfilemanager.php escalationi di privilegi] |
|---|
| Punti | 20 |
|---|