| Título | prasathmani TinyFileManager <=2.6 File Upload / Code Execution |
|---|
| Descrição | TinyFileManager <=2.6 / master 4149143 – Authenticated RCE via upload allowlist bypass (CWE-434).
Root cause in tinyfilemanager.php:1006-1086:
- Extension check on $_FILES['file']['name']
- File write to $_REQUEST['fullpath'] via move_uploaded_file() and chunked fopen()/rename()
Exploit with $allowed_upload_extensions="txt,jpg":
- Direct blocked.php -> {"status":"error"}
- filename=innocent.txt (PHP content) + fullpath=bypass_shell.php -> {"status":"success"} -> GET /bypass_shell.php?c=id executes
Requires authenticated non-readonly user. Default webroot is $_SERVER['DOCUMENT_ROOT'].
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8)
CWE-434, secondary CWE-20. Line 1011 uses && not ||.
Product: https://github.com/prasathmani/tinyfilemanager
Commit: 41491439a6b243c55502581e53fad20bc4c6e777 |
|---|
| Fonte | ⚠️ https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d |
|---|
| Utilizador | silverdragon (UID 101041) |
|---|
| Submissão | 06/09/2026 16h04 (há 2 meses) |
|---|
| Moderação | 11/10/2026 11h32 (1 month later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 416578 [prasathmani TinyFileManager até 2.6 tinyfilemanager.php move_uploaded_file fullpath Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|