| Название | prasathmani TinyFileManager <=2.6 File Upload / Code Execution |
|---|
| Описание | TinyFileManager <=2.6 / master 4149143 – Authenticated RCE via upload allowlist bypass (CWE-434).
Root cause in tinyfilemanager.php:1006-1086:
- Extension check on $_FILES['file']['name']
- File write to $_REQUEST['fullpath'] via move_uploaded_file() and chunked fopen()/rename()
Exploit with $allowed_upload_extensions="txt,jpg":
- Direct blocked.php -> {"status":"error"}
- filename=innocent.txt (PHP content) + fullpath=bypass_shell.php -> {"status":"success"} -> GET /bypass_shell.php?c=id executes
Requires authenticated non-readonly user. Default webroot is $_SERVER['DOCUMENT_ROOT'].
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8)
CWE-434, secondary CWE-20. Line 1011 uses && not ||.
Product: https://github.com/prasathmani/tinyfilemanager
Commit: 41491439a6b243c55502581e53fad20bc4c6e777 |
|---|
| Источник | ⚠️ https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d |
|---|
| Пользователь | silverdragon (UID 101041) |
|---|
| Представление | 06.09.2026 16:04 (1 месяц назад) |
|---|
| Модерация | 11.10.2026 11:32 (1 month later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 416578 [prasathmani TinyFileManager до 2.6 tinyfilemanager.php move_uploaded_file fullpath эскалация привилегий] |
|---|
| Баллы | 20 |
|---|