Is there a public PoC exploit available for CVE-2026-6497?

Yes, a public proof-of-concept exploit is available for CVE-2026-6497. Prioritise patching immediately. EPSS: 0.0%.

PHP CVE-2026-6497

Q: What is the CVSS score of CVE-2026-6497?

CVE-2026-6497 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23444 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-17 VulDB

PHP SSRF File Upload Tinyfilemanager Prasathmani

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

5.3 (MEDIUM) 2.1 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

CVSS changed

Apr 17, 2026 - 16:22 NVD

6.3 (MEDIUM) 5.3 (MEDIUM)

Analysis Generated

Apr 17, 2026 - 16:08 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 15:45 euvd

EUVD-2026-23444

Analysis Generated

Apr 17, 2026 - 15:45 vuln.today

CVE Published

Apr 17, 2026 - 15:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the file /filemanager.php?p= ajax=true&type=upload of the component File Upload Handler. This manipulation of the argument uploadurl causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery (SSRF) in TinyFileManager file upload handler (versions up to 2.6) allows authenticated remote attackers to manipulate the uploadurl parameter and forge requests to arbitrary servers. The vulnerability affects the /filemanager.php?p=&ajax=true&type=upload endpoint and has publicly available exploit code; the vendor has not responded to disclosure attempts.

Technical ContextAI

TinyFileManager is a lightweight PHP-based file management application. The vulnerability exists in the file upload functionality, specifically in how the uploadurl parameter is processed without proper validation or sanitization. This is a classic server-side request forgery (CWE-918) where user-controlled input is used to construct HTTP requests from the server itself, allowing attackers to access internal resources, interact with local services, or attack backend systems. The affected component is written in PHP and processes file uploads through the AJAX interface via the filemanager.php endpoint.

RemediationAI

No vendor-released patch is available-the vendor has not responded to disclosure. Immediate mitigation options include: (1) Disable the file upload feature entirely if not required, removing the vulnerable code path; (2) Restrict access to the /filemanager.php endpoint via firewall or web server configuration (e.g., .htaccess rules or nginx location blocks) to trusted IP ranges only; (3) Implement a Web Application Firewall (WAF) rule to block requests to /filemanager.php with ajax=true&type=upload parameters containing suspicious uploadurl values (URLs pointing to 127.0.0.1, internal IP ranges, or metadata services); (4) Enforce strong authentication and audit file upload requests, logging uploadurl values for forensic analysis. If the application is exposed to untrusted users, migration to an actively maintained file manager alternative is recommended.