TinyFileManager CVE-2026-108801

Requires an authenticated session (PR:L) on TinyFileManager version 2.6 or earlier; the attacker invokes the file-upload functionality and manipulates the fullpath parameter passed to move_uploaded_file() in tinyfilemanager.php to direct the written file to an attacker-controlled path outside the intended upload directory. No user interaction and no non-default feature toggle is required (AV:N/AC:L/UI:N). The primary limiting factor is the need for valid credentials, though this barrier is weakened in unhardened deployments because TinyFileManager historically ships with well-known default accounts; no official patch exists because the vendor did not respond to disclosure.

Signals conflict sharply and must be weighed carefully. The vendor-assigned CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, score 2.1) rates this as LOW with only minor confidentiality/integrity/availability impact, yet the described weakness - an unrestricted file upload via manipulation of the fullpath argument to move_uploaded_file() in a web-based PHP file manager - is a vulnerability class that typically yields arbitrary file write and remote code execution (webshell), which would justify HIGH impact. This is a significant discrepancy: VulDB (the assigning CNA) appears to have scored the impacts conservatively as LOW, and I assess the real impact as substantially higher than the input score suggests - verify with independent testing. On exploitation likelihood: the E:P flag and the description ('The exploit has been released to the public') confirm publicly available exploit code exists, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation - POC availability is a distinct signal from active exploitation. The PR:L metric means exploitation requires authentication, which limits blast radius versus a fully unauthenticated flaw. Net: this is a credible, publicly-exploitable issue that is likely more dangerous than its 2.1 score implies, but the authentication requirement and absence of KEV/EPSS evidence keep it below drop-everything priority; prioritize patching or mitigating internet-exposed instances.

An attacker with a low-privileged account on an internet-reachable TinyFileManager (≤2.6) instance uses the upload functionality but manipulates the fullpath argument so move_uploaded_file() writes the file to an attacker-chosen location rather than the restricted upload directory. By writing a malicious .php file into a web-accessible path, the attacker obtains a webshell and executes code on the server. Public exploit code for this flaw has been released, lowering the skill required to carry it out.