Is there a public PoC exploit available for CVE-2026-6496?

Yes, a public proof-of-concept exploit is available for CVE-2026-6496. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6496

Q: What is the CVSS score of CVE-2026-6496?

CVE-2026-6496 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23437 LOW

Path Traversal (CWE-22)

2026-04-17 VulDB

GHSA-c9vj-5wx9-69pj

PHP Path Traversal Tinyfilemanager Prasathmani

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 17, 2026 - 15:22 NVD

5.4 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 17, 2026 - 15:00 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 14:45 euvd

EUVD-2026-23437

Analysis Generated

Apr 17, 2026 - 14:45 vuln.today

CVE Published

Apr 17, 2026 - 14:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the component POST Parameter Handler. The manipulation of the argument file[] results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Path traversal in prasathmani TinyFileManager up to version 2.6 allows authenticated remote attackers to manipulate the file[] POST parameter in /filemanager.php to read, modify, or delete arbitrary files on the server outside the intended directory scope. CVSS 5.4 reflects the authenticated requirement and lack of confidentiality impact, though integrity and availability are compromised. Public exploit code exists and the vendor has not responded to disclosure, leaving users dependent on manual patching or upgrading.

Technical ContextAI

TinyFileManager is a lightweight PHP-based file management application. The vulnerability exists in the POST parameter handler of /filemanager.php, specifically in how the file[] parameter is processed. The root cause is improper input validation and sanitization of file path arguments, allowing directory traversal sequences (such as ../ or encoded variants) to escape the intended base directory. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability. The affected component processes user-supplied paths without adequate canonicalization or allowlist validation, enabling traversal to parent directories and unrestricted filesystem access.

RemediationAI

No vendor-released patch has been confirmed at time of analysis due to vendor non-responsiveness. Immediate mitigation options include: (1) Upgrade to the latest available version if one exists beyond 2.6 (check the official prasathmani/tinyfilemanager GitHub repository for the most current release); (2) Apply input validation patches if available from community forks or security researchers (search GitHub for patched forks); (3) Implement server-side request filtering to block POST requests to /filemanager.php containing path traversal sequences (../, /, backslashes, or URL-encoded variants like %2e%2e%2f); (4) Restrict file[] parameter values to a strict allowlist of permitted filenames or use basename() function to strip directory components; (5) Run TinyFileManager with minimal filesystem permissions, confining the PHP process to a chroot jail or Docker container with read-only mounts for non-editable directories; (6) Require strong, unique credentials and implement IP-based access control to limit who can reach the /filemanager.php endpoint. The trade-off of option (3) filtering is potential false positives if legitimate filenames contain these characters; option (5) adds operational complexity but provides defense-in-depth. Disabling the application entirely is the most secure option if it is not critical to operations.