| Title | prasathmani TinyFileManager <=2.6 File Upload / Code Execution |
|---|
| Description | TinyFileManager <=2.6 / master 4149143 – Authenticated RCE via upload allowlist bypass (CWE-434).
Root cause in tinyfilemanager.php:1006-1086:
- Extension check on $_FILES['file']['name']
- File write to $_REQUEST['fullpath'] via move_uploaded_file() and chunked fopen()/rename()
Exploit with $allowed_upload_extensions="txt,jpg":
- Direct blocked.php -> {"status":"error"}
- filename=innocent.txt (PHP content) + fullpath=bypass_shell.php -> {"status":"success"} -> GET /bypass_shell.php?c=id executes
Requires authenticated non-readonly user. Default webroot is $_SERVER['DOCUMENT_ROOT'].
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8)
CWE-434, secondary CWE-20. Line 1011 uses && not ||.
Product: https://github.com/prasathmani/tinyfilemanager
Commit: 41491439a6b243c55502581e53fad20bc4c6e777 |
|---|
| Source | ⚠️ https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d |
|---|
| User | silverdragon (UID 101041) |
|---|
| Submission | 09/06/2026 16:04 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:32 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416578 [prasathmani TinyFileManager up to 2.6 tinyfilemanager.php move_uploaded_file fullpath unrestricted upload] |
|---|
| Points | 20 |
|---|