CVE-2026-108801CWE-284CWE-434broken-access-controlunrestricted-file-upload

CVE-2026-108801

Medium · published October 12, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the file tinyfilemanager.php. Performing a manipulation of the argument fullpath results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00333 · 25.2th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-10-12T09:16Z
References (5)
https://gist.github.com/stoic-crawler/db2649f1df9c4b8a231122eafc92fc9d · [email protected]https://vuldb.com/cve/CVE-2026-108801 · [email protected]https://vuldb.com/submit/962457 · [email protected]https://vuldb.com/vuln/416578 · [email protected]https://vuldb.com/vuln/416578/cti · [email protected]
EPSS history
Timeline
  • 13 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 12 OCT 04:45Z
    prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload
    cvelistv5
  • 12 OCT 04:45Z
    prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload
    cvelistv5