TinyFileManager CVE-2026-116044

The attacker must have authenticated access to the target TinyFileManager instance (CVSS PR:L), reachable over the network, and the deployment must expose the Remote URL File Upload Module through which a remote attacker-controlled URL is fetched and stored without file-type/extension restriction. Full server compromise is further contingent on the uploaded file landing in a web-served, script-executable directory so a PHP payload can be invoked - this execution step is not explicitly confirmed in the sources and is the main limiting factor beyond the authentication requirement. Affected versions are TinyFileManager 2.0 through 2.6; no fixed version is identified because the vendor did not respond to the disclosure.

This is a moderate, authentication-gated risk rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) shows network-reachable, low-complexity exploitation but requires low-level privileges (PR:L) - an attacker must already be an authenticated user of TinyFileManager, which substantially limits the unauthenticated internet-wide threat. The vendor-supplied vector rates all impacts Low (VC:L/VI:L/VA:L) for a 5.3 score, but that likely understates a CWE-434 unrestricted upload: placing an arbitrary file (including PHP) into a web-served directory commonly escalates to code execution, which is why my independent assessment rates impact higher - note this conflict between the published Low impacts and the real-world webshell potential. Exploit maturity is E:P (proof-of-concept), not active exploitation: there is no CISA KEV listing and no EPSS score in the input, so there is no signal of widespread or confirmed in-the-wild use. A public PoC reference exists (a Google Drive link) but it is not verified as working exploit code. The vuln.today priority is 'this_month', consistent with a real but non-urgent issue. The vendor was contacted and did not respond, so no official fix is confirmed - a meaningful aggravating factor for defenders.

An authenticated low-privilege user of a TinyFileManager (≤2.6) instance abuses the Remote URL File Upload Module to make the application fetch and store an attacker-controlled file without restriction on type or extension. If that file is a PHP payload written to a web-accessible path, the attacker requests it to obtain a webshell and remote code execution. A public PoC reference exists but is not verified as working exploit code, so reliability is unconfirmed.